CVE-2022-0646
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's MCTP subsystem that occurs when cancel_work_sync is triggered after unregister_netdev during device removal. A local attacker could exploit this to crash the system or potentially escalate privileges. It affects Linux kernels from version 5.17-rc1 through 5.17-rc5.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, complete system compromise, or kernel panic causing system crash.
Likely Case
Local privilege escalation allowing attackers to gain root access on affected systems.
If Mitigated
Limited impact if proper access controls restrict local user accounts and kernel modules are properly sandboxed.
🎯 Exploit Status
Requires local access and knowledge of kernel exploitation techniques. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.17-rc6 and later
Vendor Advisory: https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.com.au
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.17-rc6 or later. 2. Reboot the system to load the patched kernel. 3. Verify the kernel version after reboot.
🔧 Temporary Workarounds
Disable MCTP subsystem
linuxRemove or disable the MCTP kernel module if not required
modprobe -r mctp
echo 'blacklist mctp' >> /etc/modprobe.d/blacklist.conf
🧯 If You Can't Patch
- Restrict local user access to systems with affected kernels
- Implement strict privilege separation and limit sudo/root access
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r and verify if between 5.17-rc1 and 5.17-rc5Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.17-rc6 or later after update and reboot📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- OOM killer activity
- Unexpected privilege escalation in audit logs
Network Indicators:
- None - local exploit only
SIEM Query:
source="kernel" AND ("panic" OR "Oops" OR "general protection fault")