CVE-2022-28390 – This vulnerability is a double-free memory corr... (How to Fix)

Q: What is the severity of CVE-2022-28390?

CVE-2022-28390 has a CVSS score of 7.8 (HIGH). This vulnerability is a double-free memory corruption flaw in the EMS CAN-USB driver in the Linux kernel. It allows local attackers to potentially crash the system or execute arbitrary code with kernel privileges. Systems using the ems_usb CAN driver are affected.

📋 TL;DR

This vulnerability is a double-free memory corruption flaw in the EMS CAN-USB driver in the Linux kernel. It allows local attackers to potentially crash the system or execute arbitrary code with kernel privileges. Systems using the ems_usb CAN driver are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: All versions through 5.17.1

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ems_usb CAN driver is loaded and being used.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution leading to complete system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

Limited impact if driver not loaded or system not using CAN-USB devices.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local attackers could exploit if driver is loaded.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of driver usage patterns.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel 5.17.2 and later

Vendor Advisory: https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646

Restart Required: Yes

Instructions:

1. Update kernel to 5.17.2 or later. 2. Reboot system. 3. Verify kernel version with 'uname -r'.

🔧 Temporary Workarounds

Disable ems_usb driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist ems_usb' >> /etc/modprobe.d/blacklist-ems_usb.conf
rmmod ems_usb

🧯 If You Can't Patch

Ensure ems_usb driver is not loaded (check with 'lsmod | grep ems_usb')
Restrict physical and local access to systems using CAN-USB devices

🔍 How to Verify

Check if Vulnerable:

Check kernel version with 'uname -r' and verify if <= 5.17.1, then check if ems_usb module is loaded with 'lsmod | grep ems_usb'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is >= 5.17.2 with 'uname -r' and ensure ems_usb module is not loaded or updated

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crash/panic logs
CAN driver error messages

Network Indicators:

Unusual CAN bus traffic patterns

SIEM Query:

source="kernel" AND ("oops" OR "panic" OR "ems_usb")

📊 Metadata

CVE ID: CVE-2022-28390

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: April 3, 2022

Last Updated: June 25, 2025

🔗 References

https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20220513-0001/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5127 Third Party Advisory
https://www.debian.org/security/2022/dsa-5173 Third Party Advisory
https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20220513-0001/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5127 Third Party Advisory
https://www.debian.org/security/2022/dsa-5173 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-28390, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Hci Baseboard Management Controller by Netapp

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable ems_usb driver

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities