CVE-2022-48695 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2022-48695?

CVE-2022-48695 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's mpt3sas SCSI driver that occurs during controller reset operations. Attackers with local access could potentially exploit this to cause denial of service, crash the system, or execute arbitrary code. Systems using Linux kernels with the vulnerable mpt3sas driver are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's mpt3sas SCSI driver that occurs during controller reset operations. Attackers with local access could potentially exploit this to cause denial of service, crash the system, or execute arbitrary code. Systems using Linux kernels with the vulnerable mpt3sas driver are affected.

💻 Affected Systems

Products:

Linux kernel with mpt3sas driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using mpt3sas driver for LSI SAS controllers. Requires triggering a controller reset.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service during SCSI controller reset operations.

🟢

If Mitigated

System remains stable if the vulnerability is not triggered during controller resets.

🌐 Internet-Facing: LOW - This requires local access to the system.

🏢 Internal Only: MEDIUM - Internal users with local access could potentially exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger SCSI controller reset. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits listed in references

Vendor Advisory: https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable mpt3sas module

linux

Prevent loading of vulnerable driver if not needed

echo 'blacklist mpt3sas' >> /etc/modprobe.d/blacklist.conf
rmmod mpt3sas

Restrict SCSI controller reset operations

linux

Limit ability to trigger controller resets

chmod 600 /sys/class/scsi_host/*/reset

🧯 If You Can't Patch

Restrict local access to systems using mpt3sas driver
Implement strict access controls to prevent unauthorized users from triggering SCSI operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if mpt3sas module is loaded: lsmod | grep mpt3sas

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check dmesg for absence of refcount warnings during controller operations

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing 'refcount_t: underflow; use-after-free' warnings
System crashes during SCSI controller operations

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND "refcount_t: underflow" OR "use-after-free" AND "mpt3sas"

📊 Metadata

CVE ID: CVE-2022-48695

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 3, 2024

Last Updated: December 26, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-48695, you might also want to check these: