CVE-2022-49180
📋 TL;DR
This Linux kernel vulnerability involves incorrect error handling in the LSM (Linux Security Module) framework when processing mount options. It can cause a general protection fault (kernel crash) when security modules like Smack and SELinux return inconsistent error codes. Systems using Linux kernels with affected LSM implementations are vulnerable.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially disrupting critical services.
Likely Case
System instability or crash when processing certain mount operations with specific security module configurations.
If Mitigated
No impact if patched or if affected security modules are not in use.
🎯 Exploit Status
Exploitation requires local access and ability to trigger mount operations with specific parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing the fixes from the provided git commits
Vendor Advisory: https://git.kernel.org/stable/c/00fc07fa0b4a004711b6e1a944f0d2e46f7093b7
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable affected LSM modules
linuxTemporarily disable Smack or SELinux if not required for security policy
setenforce 0
echo 0 > /sys/fs/smackfs/load2
🧯 If You Can't Patch
- Restrict mount operations to trusted users only
- Monitor system logs for kernel panic events related to mount operations
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if it includes the vulnerable LSM code from git commitsCheck Version:
uname -rVerify Fix Applied:
Verify kernel version matches patched version from distribution vendor📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- General protection fault errors in dmesg
- Mount operation failures
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="kernel" AND ("general protection fault" OR "LSM" OR "legacy_parse_param")🔗 References
- https://git.kernel.org/stable/c/00fc07fa0b4a004711b6e1a944f0d2e46f7093b7
- https://git.kernel.org/stable/c/2784604c8c6fc523248f8f80a421c313a9d790b7
- https://git.kernel.org/stable/c/cadae7c5e477aaafcba819b8e4a3d1c1a1503b62
- https://git.kernel.org/stable/c/ddcdda888e14ca451b3ee83d11b65b2a9c8e783b
- https://git.kernel.org/stable/c/ecff30575b5ad0eda149aadad247b7f75411fd47
- https://git.kernel.org/stable/c/f3f93a1aaafc3032e0a9655fb43deccfb3e953a3
