CVE-2022-48954
📋 TL;DR
This is a use-after-free vulnerability in the Linux kernel's s390/qeth driver that occurs during bridge-to-device event handling. An attacker could potentially exploit this to cause kernel memory corruption, leading to system crashes or arbitrary code execution. Systems running Linux kernel versions with the vulnerable qeth driver on s390 architecture are affected.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to denial of service, or potential arbitrary code execution with kernel privileges resulting in complete system compromise.
Likely Case
System crash or kernel panic causing denial of service, requiring system reboot to restore functionality.
If Mitigated
No impact if the vulnerable driver is not loaded or if the system is patched.
🎯 Exploit Status
Exploitation requires triggering specific bridge network events. The vulnerability was discovered through KASAN testing, suggesting it may be difficult to reliably exploit for arbitrary code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in kernel commits bde0dfc7c456, db6343a5b0d9, and ebaaadc332cd
Vendor Advisory: https://git.kernel.org/stable/c/bde0dfc7c4569406a6ddeec363d04a1df7b3073f
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Unload qeth driver
linuxRemove the vulnerable qeth driver module if not required for system operation
modprobe -r qeth_l2
modprobe -r qeth
Disable bridge events
linuxPrevent bridge-to-device events that trigger the vulnerability
echo 0 > /sys/class/net/<bridge>/bridge/group_fwd_mask
bridge link set dev <interface> guard off
🧯 If You Can't Patch
- Restrict network bridge configuration to trusted users only
- Implement network segmentation to limit bridge event exposure
🔍 How to Verify
Check if Vulnerable:
Check if qeth driver is loaded: lsmod | grep qeth. Check kernel version against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits: uname -r. Check /proc/version for commit hashes.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- KASAN reports of use-after-free in qeth_l2_br2dev_worker
- System crash/reboot events
Network Indicators:
- Unusual bridge configuration changes
- Multiple bridge FDB (Forwarding Database) updates
SIEM Query:
event.category:kernel AND (qeth_l2_br2dev_worker OR "use-after-free")