CVE-2022-48742
📋 TL;DR
This is a use-after-free vulnerability in the Linux kernel's rtnetlink component that could allow local attackers to crash the system or potentially execute arbitrary code. It affects Linux systems with vulnerable kernel versions where an attacker has local access. The vulnerability occurs during network interface configuration operations.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to complete system compromise.
Likely Case
Kernel panic or system crash causing denial of service.
If Mitigated
Limited impact if proper access controls prevent local users from executing privileged network operations.
🎯 Exploit Status
Exploitation requires local access and ability to perform network configuration operations. The vulnerability was discovered during fuzzing (syzbot).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel versions with fixes (see git references in CVE)
Vendor Advisory: https://git.kernel.org/stable/c/2cf180360d66bd657e606c1217e0e668e6faa303
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Restrict CAP_NET_ADMIN
linuxLimit which users have CAP_NET_ADMIN capability to reduce attack surface.
# Remove CAP_NET_ADMIN from non-essential users
# Check current capabilities: capsh --print
# Modify capabilities in /etc/security/capability.conf or using setcap
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from performing network configuration operations
- Monitor for unusual rtnetlink activity or kernel panic events
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with patched versions from distribution advisories. Vulnerable if using unpatched kernel with commit before fixes.Check Version:
uname -rVerify Fix Applied:
Verify kernel version matches patched version from your distribution. Check that kernel includes the fix commits referenced in CVE.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- Oops messages in dmesg or /var/log/kern.log
- Unexpected system crashes
Network Indicators:
- Unusual rtnetlink traffic from non-privileged users
SIEM Query:
source="kernel" AND ("Oops" OR "panic" OR "use-after-free")🔗 References
- https://git.kernel.org/stable/c/2cf180360d66bd657e606c1217e0e668e6faa303
- https://git.kernel.org/stable/c/36a9a0aee881940476b254e0352581401b23f210
- https://git.kernel.org/stable/c/3bbe2019dd12b8d13671ee6cda055d49637b4c39
- https://git.kernel.org/stable/c/7d9211678c0f0624f74cdff36117ab8316697bb8
- https://git.kernel.org/stable/c/a01e60a1ec6bef9be471fb7182a33c6d6f124e93
- https://git.kernel.org/stable/c/bd43771ee9759dd9dfae946bff190e2c5a120de5
- https://git.kernel.org/stable/c/c6f6f2444bdbe0079e41914a35081530d0409963
- https://git.kernel.org/stable/c/def5e7070079b2a214b3b1a2fbec623e6fbfe34a
- https://git.kernel.org/stable/c/2cf180360d66bd657e606c1217e0e668e6faa303
- https://git.kernel.org/stable/c/36a9a0aee881940476b254e0352581401b23f210
- https://git.kernel.org/stable/c/3bbe2019dd12b8d13671ee6cda055d49637b4c39
- https://git.kernel.org/stable/c/7d9211678c0f0624f74cdff36117ab8316697bb8
- https://git.kernel.org/stable/c/a01e60a1ec6bef9be471fb7182a33c6d6f124e93
- https://git.kernel.org/stable/c/bd43771ee9759dd9dfae946bff190e2c5a120de5
- https://git.kernel.org/stable/c/c6f6f2444bdbe0079e41914a35081530d0409963
- https://git.kernel.org/stable/c/def5e7070079b2a214b3b1a2fbec623e6fbfe34a
