Critical Double Add Vulnerability in Linux Kernel UVC Gadget Package
Summary
CVE-2022-49686: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix list double add in uvcg_video_pump A panic can occur if the endpoint becomes disabled and the uvcg_video_pump adds the request bac... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system. The UVC (USB Video Class) gadget is a subsystem within the Linux kernel that allows devices to act as USB video devices. This subsystem is crucial for applications that require video input, such as webcams. The vulnerability in question affects the UVC gadget, specifically in how it handles requests when an endpoint is disabled.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49686, arises from a flaw in the uvcg_video_pump function within the UVC gadget. When an endpoint becomes disabled, the function erroneously attempts to add a request back to the req_free list after it has already been queued to the endpoint. This leads to a double addition to the list, which can cause a kernel panic. The panic occurs due to a kernel bug triggered by the improper handling of request lists, potentially leading to system instability and crashes.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
CVE-2022-49686 represents a significant vulnerability within the Linux kernel's UVC gadget, leading to potential system crashes. Users are strongly encouraged to update their systems to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure software environment.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49686 is a vulnerability in the Linux kernel's UVC gadget that can lead to a kernel panic due to improper handling of request lists.
If exploited, this vulnerability can cause system instability and crashes, potentially leading to data loss or corruption.
Versions of the Linux kernel prior to 5.18.14-1 are affected. It is recommended to check your kernel version and update accordingly.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and apply the update as soon as possible.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
