CVE-2022-49410
📋 TL;DR
This CVE describes a double-free vulnerability in the Linux kernel's tracing subsystem. When create_var_ref() encounters an error during initialization, it can free memory that gets freed again during error handling, potentially leading to memory corruption. This affects all Linux systems using kernel tracing functionality.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic, system crash, or potential privilege escalation if an attacker can trigger the double-free and control memory allocation patterns.
Likely Case
System instability, kernel crashes, or denial of service when tracing operations encounter errors.
If Mitigated
Minimal impact if tracing functionality is disabled or not used.
🎯 Exploit Status
Exploitation requires local access and ability to trigger specific error conditions in the tracing subsystem. No known public exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in stable kernel versions via commits referenced in CVE
Vendor Advisory: https://git.kernel.org/stable/c/058cb6d86b9789377216c936506b346aaa1eb581
Restart Required: Yes
Instructions:
1. Update to patched kernel version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable kernel tracing
allDisable ftrace and related tracing functionality to prevent vulnerability trigger
echo 0 > /sys/kernel/debug/tracing/tracing_on
echo nop > /sys/kernel/debug/tracing/current_tracer
🧯 If You Can't Patch
- Disable all kernel tracing functionality via sysfs
- Restrict access to tracing debugfs interface to privileged users only
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with patched versions from distribution vendor. Vulnerable if using unpatched kernel with tracing enabled.Check Version:
uname -rVerify Fix Applied:
Verify kernel version matches patched version from vendor and test tracing functionality works without crashes.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages
- System crashes during tracing operations
- dmesg errors related to memory corruption or double-free
Network Indicators:
- None - local vulnerability only
SIEM Query:
Search for kernel panic events or memory corruption errors in system logs🔗 References
- https://git.kernel.org/stable/c/058cb6d86b9789377216c936506b346aaa1eb581
- https://git.kernel.org/stable/c/37443b3508b8cce6832f8d25cb4550b2f7801f50
- https://git.kernel.org/stable/c/4fdfb15e08598711dbf50daf56a33965232daf0e
- https://git.kernel.org/stable/c/99696a2592bca641eb88cc9a80c90e591afebd0f
- https://git.kernel.org/stable/c/bd83ff3bbfb003832481c9bff999d12385f396ae
- https://git.kernel.org/stable/c/c27f744ceefadc7bbeb14233b6abc150ced617d2
- https://git.kernel.org/stable/c/f8b383f83cb573152c577eca1ef101e89995b72a
