CVE-2022-48782
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) subsystem. When mctp_key_add() fails, memory is freed but then incorrectly accessed in trace_mctp_key_acquire(), potentially allowing local attackers to crash the system or execute arbitrary code. This affects systems running vulnerable Linux kernel versions with MCTP enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to complete system compromise.
Likely Case
Kernel panic or system crash causing denial of service.
If Mitigated
No impact if MCTP is disabled or system is patched.
🎯 Exploit Status
Requires local access and MCTP functionality to be active. Exploitation would require triggering the specific code path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in stable kernel versions via commits 1dd3ecbec5f606b2a526c47925c8634b1a6bb81e and 7e5b6a5c8c44310784c88c1c198dde79f6402f7b
Vendor Advisory: https://git.kernel.org/stable/c/1dd3ecbec5f606b2a526c47925c8634b1a6bb81e
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable MCTP subsystem
linuxDisable the MCTP kernel module if not required
echo 'blacklist mctp' >> /etc/modprobe.d/blacklist-mctp.conf
rmmod mctp
🧯 If You Can't Patch
- Disable MCTP functionality if not required
- Restrict local user access to systems where MCTP is enabled
🔍 How to Verify
Check if Vulnerable:
Check if MCTP module is loaded: lsmod | grep mctp. If loaded, check kernel version against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated and MCTP module loads without errors in dmesg.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages
- System crashes/panics
- dmesg errors related to MCTP or use-after-free
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Not applicable for network detection