CVE-2022-48854
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's arc_emac network driver. When the arc_mdio_probe() function fails during MDIO bus initialization, it frees memory but continues to use the freed 'bus' pointer to access the bus name, potentially leading to memory corruption. This affects Linux systems using the arc_emac driver for ARC Ethernet MAC controllers.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic, system crash, or potential local privilege escalation to kernel-level code execution leading to complete system compromise.
Likely Case
System instability, kernel panic, or denial of service causing system crashes or reboots.
If Mitigated
Limited impact if system crashes without privilege escalation, requiring physical or remote console access to restart.
🎯 Exploit Status
Exploitation requires local access and ability to trigger the specific error condition in arc_mdio_probe(). The vulnerability is in error handling code path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in kernel commits 84c831803785c2c3bec5c28c0e8a0b72f6b41d4d and bc0e610a6eb0d46e4123fafdbe5e6141d9fff3be
Vendor Advisory: https://git.kernel.org/stable/c/84c831803785c2c3bec5c28c0e8a0b72f6b41d4d
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for patched kernel packages. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable arc_emac module
linuxPrevent loading of the vulnerable arc_emac kernel module if not needed
echo 'blacklist arc_emac' >> /etc/modprobe.d/blacklist.conf
rmmod arc_emac
🧯 If You Can't Patch
- Ensure systems using arc_emac driver have restricted local user access
- Monitor system logs for kernel panics or crashes related to network driver initialization
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if arc_emac module is loaded: lsmod | grep arc_emac && uname -rCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is patched and check dmesg for arc_emac driver loading without errors📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- Oops messages in dmesg
- System crashes during network initialization
Network Indicators:
- None - this is a local kernel vulnerability
SIEM Query:
search 'kernel panic' OR 'Oops' OR 'arc_emac' in system logs