CVE-2022-49686 (GCVE-0-2022-49686)
Vulnerability from cvelistv5
Published
2025-02-26 02:24
Modified
2025-05-04 08:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix list double add in uvcg_video_pump
A panic can occur if the endpoint becomes disabled and the
uvcg_video_pump adds the request back to the req_free list after it has
already been queued to the endpoint. The endpoint complete will add the
request back to the req_free list. Invalidate the local request handle
once it's been queued.
<6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0)
<3>[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90.
<6>[ 246.797213][ T26] ------------[ cut here ]------------
<2>[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31!
<6>[ 246.807073][ T26] Call trace:
<6>[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c
<6>[ 246.807366][ T26] process_one_work+0x2a4/0x544
<6>[ 246.807394][ T26] worker_thread+0x350/0x784
<6>[ 246.807442][ T26] kthread+0x2ac/0x320
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/uvc_video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d95ac8b920de1d39525fadc408ce675697626ca6",
"status": "affected",
"version": "f9897ec0f6d34e8b2bc2f4c8ab8789351090f3d2",
"versionType": "git"
},
{
"lessThan": "96163f835e65f8c9897487fac965819f0651d671",
"status": "affected",
"version": "f9897ec0f6d34e8b2bc2f4c8ab8789351090f3d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/uvc_video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix list double add in uvcg_video_pump\n\nA panic can occur if the endpoint becomes disabled and the\nuvcg_video_pump adds the request back to the req_free list after it has\nalready been queued to the endpoint. The endpoint complete will add the\nrequest back to the req_free list. Invalidate the local request handle\nonce it\u0027s been queued.\n\n\u003c6\u003e[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0)\n\u003c3\u003e[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90.\n\u003c6\u003e[ 246.797213][ T26] ------------[ cut here ]------------\n\u003c2\u003e[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31!\n\u003c6\u003e[ 246.807073][ T26] Call trace:\n\u003c6\u003e[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c\n\u003c6\u003e[ 246.807366][ T26] process_one_work+0x2a4/0x544\n\u003c6\u003e[ 246.807394][ T26] worker_thread+0x350/0x784\n\u003c6\u003e[ 246.807442][ T26] kthread+0x2ac/0x320"
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:43:18.743Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d95ac8b920de1d39525fadc408ce675697626ca6"
},
{
"url": "https://git.kernel.org/stable/c/96163f835e65f8c9897487fac965819f0651d671"
}
],
"title": "usb: gadget: uvc: fix list double add in uvcg_video_pump",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49686",
"datePublished": "2025-02-26T02:24:12.624Z",
"dateReserved": "2025-02-26T02:21:30.441Z",
"dateUpdated": "2025-05-04T08:43:18.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-49686\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:43.437\",\"lastModified\":\"2025-02-26T07:01:43.437\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: uvc: fix list double add in uvcg_video_pump\\n\\nA panic can occur if the endpoint becomes disabled and the\\nuvcg_video_pump adds the request back to the req_free list after it has\\nalready been queued to the endpoint. The endpoint complete will add the\\nrequest back to the req_free list. Invalidate the local request handle\\nonce it\u0027s been queued.\\n\\n\u003c6\u003e[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0)\\n\u003c3\u003e[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90.\\n\u003c6\u003e[ 246.797213][ T26] ------------[ cut here ]------------\\n\u003c2\u003e[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31!\\n\u003c6\u003e[ 246.807073][ T26] Call trace:\\n\u003c6\u003e[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c\\n\u003c6\u003e[ 246.807366][ T26] process_one_work+0x2a4/0x544\\n\u003c6\u003e[ 246.807394][ T26] worker_thread+0x350/0x784\\n\u003c6\u003e[ 246.807442][ T26] kthread+0x2ac/0x320\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: uvc: fix list double add in uvcg_video_pump Puede producirse un p\u00e1nico si el endpoint se deshabilita y uvcg_video_pump agrega la solicitud nuevamente a la lista req_free despu\u00e9s de que ya se haya puesto en cola en el endpoint. La finalizaci\u00f3n del endpoint agregar\u00e1 la solicitud nuevamente a la lista req_free. Invalida el identificador de solicitud local una vez que se haya puesto en cola. \u0026lt;6\u0026gt;[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0) \u0026lt;3\u0026gt;[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90. \u0026lt;6\u0026gt;[ 246.797213][ T26] ------------[ cut here ]------------ \u0026lt;2\u0026gt;[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31! \u0026lt;6\u0026gt;[ 246.807073][ T26] Call trace: \u0026lt;6\u0026gt;[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c \u0026lt;6\u0026gt;[ 246.807366][ T26] process_one_work+0x2a4/0x544 \u0026lt;6\u0026gt;[ 246.807394][ T26] worker_thread+0x350/0x784 \u0026lt;6\u0026gt;[ 246.807442][ T26] kthread+0x2ac/0x320 \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/96163f835e65f8c9897487fac965819f0651d671\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d95ac8b920de1d39525fadc408ce675697626ca6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}