Bug 2347702 (CVE-2022-49306)

Summary:	CVE-2022-49306 kernel: usb: dwc3: host: Stop setting the ACPI companion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-26 03:03:45 UTC

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: host: Stop setting the ACPI companion

It is no longer needed. The sysdev pointer is now used when
assigning the ACPI companions to the xHCI ports and USB
devices.

Assigning the ACPI companion here resulted in the
fwnode->secondary pointer to be replaced also for the parent
dwc3 device since the primary fwnode (the ACPI companion)
was shared. That was unintentional and it created potential
side effects like resource leaks.

Comment 1 Avinash Hanwate 2025-02-26 14:30:57 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022635-CVE-2022-49306-a115@gregkh/T

Comment 4 Avinash Hanwate 2025-02-26 18:34:04 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022635-CVE-2022-49306-a115@gregkh/T