CVE-2022-49470 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2022-49470?

CVE-2022-49470 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's Bluetooth MediaTek SDIO driver allows attackers to potentially execute arbitrary code or cause system crashes. This affects Linux systems using the btmtksdio driver for MediaTek Bluetooth chips. The vulnerability occurs when accessing freed memory in the btmtksdio_recv_event function after hci_recv_frame is called.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's Bluetooth MediaTek SDIO driver allows attackers to potentially execute arbitrary code or cause system crashes. This affects Linux systems using the btmtksdio driver for MediaTek Bluetooth chips. The vulnerability occurs when accessing freed memory in the btmtksdio_recv_event function after hci_recv_frame is called.

💻 Affected Systems

Products:

Linux kernel with btmtksdio driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using MediaTek Bluetooth chips with SDIO interface. Requires the btmtksdio driver to be loaded and active.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

System crash or kernel panic causing denial of service.

🟢

If Mitigated

Limited impact with proper kernel hardening and exploit mitigations like KASAN.

🌐 Internet-Facing: LOW - Requires local access or Bluetooth proximity.

🏢 Internal Only: MEDIUM - Local attackers or malicious Bluetooth devices could exploit this.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access or Bluetooth proximity. Exploitation requires triggering specific Bluetooth events to reach the vulnerable code path.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 01c6a899fa6be4f4cbf60c4f44f0f6691155415f, 02ba31e09a26e8cd4582ac8e6163d80284997727, 0fab6361c4ba17d1b43a991bef4238a3c1754d35, b3cec8a42fcd11d05313c724f27e01b1db77522c

Vendor Advisory: https://git.kernel.org/stable/c/01c6a899fa6be4f4cbf60c4f44f0f6691155415f

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable btmtksdio driver

Linux

Prevent loading of the vulnerable driver module

echo 'blacklist btmtksdio' >> /etc/modprobe.d/blacklist-btmtksdio.conf
rmmod btmtksdio

Disable Bluetooth

Linux

Turn off Bluetooth functionality completely

systemctl stop bluetooth
systemctl disable bluetooth
rfkill block bluetooth

🧯 If You Can't Patch

Disable Bluetooth functionality entirely
Use kernel hardening features like KASAN to detect exploitation attempts

🔍 How to Verify

Check if Vulnerable:

Check if btmtksdio driver is loaded: lsmod | grep btmtksdio. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check that btmtksdio driver functions without KASAN errors.

📡 Detection & Monitoring

Log Indicators:

KASAN reports of use-after-free in btmtksdio_recv_event
Kernel panic or oops messages related to Bluetooth

Network Indicators:

Unusual Bluetooth connection attempts
Bluetooth protocol anomalies

SIEM Query:

kernel: "BUG: KASAN: use-after-free in btmtksdio_recv_event" OR kernel: "btmtksdio: use-after-free"

📊 Metadata

CVE ID: CVE-2022-49470

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (11th percentile)

Published: February 26, 2025

Last Updated: March 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49470, you might also want to check these: