Linux Kernel USB Gadget Composite Driver Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's USB gadget composite driver. This issue arises in the 'composite_dev_cleanup()' function, specifically within the 'configfs_composite_bind()' process. When memory allocation fails, the 'os_desc_req' pointer is freed but not set to NULL, leading to a potential use-after-free scenario. The vulnerability has been addressed in the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, allowing for potential memory corruption.

Reproduction

The vulnerability can be reproduced by triggering a memory allocation failure in the 'composite_os_desc_req_prepare()' function. This will cause the 'os_desc_req' pointer to be freed without being nullified. Subsequently, the 'composite_dev_cleanup()' function will attempt to use the now-invalid pointer, leading to a use-after-free vulnerability.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree where this vulnerability has been fixed.