CVE-2022-49350
📋 TL;DR
This CVE describes a Linux kernel vulnerability where the mdio_bus_init() function was incorrectly marked with both EXPORT_SYMBOL and __init annotations. This combination can cause kernel panic if a module attempts to use this function after kernel initialization, as the function's memory section may have been freed. The vulnerability affects Linux systems with specific kernel versions that include the flawed code.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially requiring physical or remote console access to reboot the system.
Likely Case
System instability or crash when loading certain kernel modules that attempt to use the mdio_bus_init() function after initialization.
If Mitigated
No impact if the vulnerable code path is not triggered by module loading or if the system is patched.
🎯 Exploit Status
Exploitation requires ability to load kernel modules and trigger the specific code path. This typically requires local access with appropriate privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing fixes from the provided git commits (e.g., 35b42dce619701f1300fb8498dae82c9bb1f0263 and others)
Vendor Advisory: https://git.kernel.org/stable/c/35b42dce619701f1300fb8498dae82c9bb1f0263
Restart Required: Yes
Instructions:
1. Update Linux kernel to a version containing the fix. 2. Check your distribution's security advisories for specific patched kernel versions. 3. Reboot the system to load the new kernel.
🔧 Temporary Workarounds
Restrict kernel module loading
linuxPrevent unauthorized kernel module loading to reduce attack surface
echo 1 > /proc/sys/kernel/modules_disabled
sysctl -w kernel.modules_disabled=1
Disable unnecessary kernel modules
linuxRemove or blacklist modules that might trigger the vulnerable code path
echo 'blacklist phylib' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
🧯 If You Can't Patch
- Restrict user privileges to prevent kernel module loading
- Implement strict access controls and monitor for unauthorized module loading attempts
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with patched versions from git commits. Examine if CONFIG_PHYLIB is built as module.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to a version containing the fix commits. Check that mdio_bus_init is no longer exported.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- Failed module loading attempts related to mdio or phylib
Network Indicators:
- Unusual system reboots or crashes
SIEM Query:
source="kern.log" AND "kernel panic" OR "Oops" OR "Unable to handle kernel paging request"🔗 References
- https://git.kernel.org/stable/c/35b42dce619701f1300fb8498dae82c9bb1f0263
- https://git.kernel.org/stable/c/5534bcd7c40299862237c4a8fd9c5031b3db1538
- https://git.kernel.org/stable/c/59fa94cddf9eef8d8dae587373eed8b8f4eb11d7
- https://git.kernel.org/stable/c/6a90a44d53428a3bf01bd80df9ba78b19959270c
- https://git.kernel.org/stable/c/7759c3222815b945a94b212bc0c6cdec475cfec2
- https://git.kernel.org/stable/c/ab64ec2c75683f30ccde9eaaf0761002f901aa12
- https://git.kernel.org/stable/c/f2f0f8c18b60ca64ff50892ed899cf1c77864755
- https://git.kernel.org/stable/c/f5c68137f1191ba3fcf6260ec71b30be2e2bf4c3
