CVE-2022-49275 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-49275?

CVE-2022-49275 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's CAN (Controller Area Network) subsystem affecting m_can drivers. It allows attackers with local access to potentially crash the system or execute arbitrary code by exploiting improper skb (socket buffer) handling during transmission. Systems running affected Linux kernel versions with CAN hardware are vulnerable.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's CAN (Controller Area Network) subsystem affecting m_can drivers. It allows attackers with local access to potentially crash the system or execute arbitrary code by exploiting improper skb (socket buffer) handling during transmission. Systems running affected Linux kernel versions with CAN hardware are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific versions with m_can driver vulnerability; check kernel commit history for exact ranges

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if CAN subsystem is enabled and m_can drivers are loaded/used. Many systems don't use CAN interfaces by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise and potential persistence.

🟠

Likely Case

Kernel panic or system crash causing denial of service, potentially requiring physical intervention to restart.

🟢

If Mitigated

No impact if CAN interfaces are disabled or unused, or if proper access controls prevent local user exploitation.

🌐 Internet-Facing: LOW - Requires local access to the system; not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this, but requires CAN hardware/drivers to be active.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of CAN subsystem exploitation. Use-after-free vulnerabilities can be challenging to exploit reliably.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 08d90846e438ac22dc56fc49ec0b0d195831c5ed, 2e8e79c416aae1de224c0f1860f2e3350fa171f8, 31417073493f302d26ab66b3abc098d43227b835, 4db7d6f481990dd179a9ee7126dc7aa31ea4fff3, 7728d937ec403a1ceff9483023252d2cb8777f81

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable CAN subsystem

all

Unload m_can drivers and disable CAN interfaces if not needed

sudo rmmod m_can
sudo modprobe -r m_can
sudo systemctl disable can* services if applicable

Restrict local access

all

Implement strict access controls to prevent unauthorized local users

sudo userdel unauthorized_user
sudo passwd -l suspicious_account

🧯 If You Can't Patch

Disable CAN hardware interfaces in BIOS/UEFI if possible
Implement strict mandatory access controls (SELinux/AppArmor) to limit kernel exploitation impact

🔍 How to Verify

Check if Vulnerable:

Check if m_can module is loaded: lsmod | grep m_can AND check kernel version against vulnerable ranges

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated AND m_can module loads without errors in dmesg

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages in dmesg
CAN subsystem crashes in system logs
Unexpected m_can module reloads

Network Indicators:

Unusual CAN bus traffic patterns if monitored

SIEM Query:

source="kernel" AND ("m_can" OR "CAN" OR "use-after-free") AND severity=high

📊 Metadata

CVE ID: CVE-2022-49275

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.03% exploit probability (9.6th percentile)

Published: February 26, 2025

Last Updated: March 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49275, you might also want to check these: