CVE-2022-49524 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2022-49524?

CVE-2022-49524 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's cx23885 media driver. When the driver fails to set DMA mask during device initialization, it doesn't properly clean up previously allocated I2C resources, leading to memory corruption. This affects Linux systems using cx23885-based TV tuner/capture cards.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's cx23885 media driver. When the driver fails to set DMA mask during device initialization, it doesn't properly clean up previously allocated I2C resources, leading to memory corruption. This affects Linux systems using cx23885-based TV tuner/capture cards.

💻 Affected Systems

Products:

Linux kernel with cx23885 driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if cx23885 driver is loaded (typically requires specific TV tuner/capture hardware)

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or potential privilege escalation to kernel mode execution

🟠

Likely Case

System instability, crashes, or denial of service when loading/unloading the cx23885 driver

🟢

If Mitigated

Driver fails to load cleanly but system remains stable

🌐 Internet-Facing: LOW - Requires local access to load/unload kernel modules

🏢 Internal Only: MEDIUM - Requires local access but could be exploited by malicious users or compromised applications

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to load/unload kernel modules (typically requires root or CAP_SYS_MODULE)

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 453514a874c78df1e7804e6e3aaa60c8d8deb6a8 or later

Vendor Advisory: https://git.kernel.org/stable/c/453514a874c78df1e7804e6e3aaa60c8d8deb6a8

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commit. 2. Reboot system. 3. Verify kernel version and that cx23885 module loads without errors.

🔧 Temporary Workarounds

Blacklist cx23885 module

Linux

Prevent loading of vulnerable driver module

echo 'blacklist cx23885' >> /etc/modprobe.d/blacklist-cx23885.conf
rmmod cx23885 2>/dev/null || true

🧯 If You Can't Patch

Restrict module loading to trusted users only (remove CAP_SYS_MODULE from untrusted users)
Monitor for cx23885 module loading/unloading events in system logs

🔍 How to Verify

Check if Vulnerable:

Check if cx23885 module is loaded: lsmod | grep cx23885. Check kernel version against distribution's security advisories.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commit. Test loading cx23885 module: modprobe cx23885 (should succeed without KASAN errors).

📡 Detection & Monitoring

Log Indicators:

KASAN use-after-free reports in dmesg
Kernel oops or panic messages related to cx23885
Failed dma_set_mask() calls in kernel logs

SIEM Query:

source="kernel" AND ("cx23885" OR "use-after-free" OR "KASAN")

📊 Metadata

CVE ID: CVE-2022-49524

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.03% exploit probability (7.8th percentile)

Published: February 26, 2025

Last Updated: March 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49524, you might also want to check these: