From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07EED32BC07 for ; Wed, 17 Sep 2025 14:58:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758121113; cv=none; b=l6ZttKkx0CLhDbwdRbErgs8kYk7wKmGW9UTrNZYAtd41FuURuQGlEjUERNEbCXdSptVa3NEqoByY2SlasvwVES7JqnV4UkJTSL1u8xrgUEdjNIGd/g5d5VJ5tvMqPT9Bn+H0HAM2nfBql2jV0KtpvqCmAzT3ds370a8fLJnmBK8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758121113; c=relaxed/simple; bh=GVL5v4vN8zcVbDjOHJpu78jBe5K6M4YsGx5hlk/M66c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RyyxBGC8Pr4IANAoth/6KusL7SlsuTA71012UHtpSQbClaXIyn7+c4jR1vXj+v490xlIvyGM83oUddgrnn7i6x1syM7999VvdypMgoiolQCZjUOvxXWQEU/SuHXkzgrmIUQBsvz+I0oHI4zUJ5OAow4sfJV9gsEXk9zV0u64BR8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NtbNDpdk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="NtbNDpdk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27F96C4CEE7; Wed, 17 Sep 2025 14:58:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1758121112; bh=GVL5v4vN8zcVbDjOHJpu78jBe5K6M4YsGx5hlk/M66c=; h=From:To:Cc:Subject:Date:Reply-to:From; b=NtbNDpdk30KdQ6eWkI3awuv/cEyxugLXUsSiavUSo0+Ad49y2wKpEQ58niHiEARwA 3kq/WNo8N7vW4/AwarFUJNbB00R/zOG6rZS9QORbKo49TsMXndWDImVzGZGfeme3ez yQgmgQEC0d7tH3MbWfPTTSXPO/DypLg4aDeN55MY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-50357: usb: dwc3: core: fix some leaks in probe Date: Wed, 17 Sep 2025 16:56:16 +0200 Message-ID: <2025091714-CVE-2022-50357-4ae9@gregkh> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2145; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=MphN+xpCJAKZYuSi32ysVNq//BCnnmP1WyxiCN9A5Vo=; b=owGbwMvMwCRo6H6F97bub03G02pJDBmnzvBZ1CufnNq2JHB6plPvHI+HuxfwP0lPv/9LP2yVN Ju8zo7yjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjI1C6GeVaakzZtXpV31KPT MfDk8SVvV5tPv8EwVyps24xnc7oe738WIaCn49OmlnImEQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: fix some leaks in probe The dwc3_get_properties() function calls: dwc->usb_psy = power_supply_get_by_name(usb_psy_name); so there is some additional clean up required on these error paths. The Linux kernel CVE team has assigned CVE-2022-50357 to this issue. Affected and fixed versions =========================== Issue introduced in 5.13 with commit 6f0764b5adea18d70c3fab32d5f940678bcbd865 and fixed in 5.19.17 with commit 79c3afb55942368921237d7b5355d48c52bdde20 Issue introduced in 5.13 with commit 6f0764b5adea18d70c3fab32d5f940678bcbd865 and fixed in 6.0.3 with commit 3a213503f483173e7eea76f2e7e3bdd6df7fd6f8 Issue introduced in 5.13 with commit 6f0764b5adea18d70c3fab32d5f940678bcbd865 and fixed in 6.1 with commit 2a735e4b5580a2a6bbd6572109b4c4f163c57462 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-50357 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/dwc3/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/79c3afb55942368921237d7b5355d48c52bdde20 https://git.kernel.org/stable/c/3a213503f483173e7eea76f2e7e3bdd6df7fd6f8 https://git.kernel.org/stable/c/2a735e4b5580a2a6bbd6572109b4c4f163c57462