CVE-2022-49867
📋 TL;DR
This CVE describes a memory leak vulnerability in the Linux kernel's IOSM WWAN driver. When network devices are unregistered, the driver fails to properly free allocated memory, causing gradual memory exhaustion. This affects systems using the IOSM WWAN driver for cellular modem connectivity.
💻 Affected Systems
- Linux kernel with IOSM WWAN driver enabled
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could lead to complete system memory exhaustion, causing kernel panics, system crashes, or denial of service on affected devices.
Likely Case
Gradual memory consumption over time leading to system instability, performance degradation, and potential service disruption requiring reboots.
If Mitigated
With proper patching, no impact beyond normal system operation.
🎯 Exploit Status
Exploitation requires ability to trigger network device registration/unregistration in the IOSM driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commit 128514b51a5ba2c82f9e4a106f1c10423907618a or later
Vendor Advisory: https://git.kernel.org/stable/c/128514b51a5ba2c82f9e4a106f1c10423907618a
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commit. 2. Rebuild kernel if compiling from source. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Disable IOSM WWAN driver
linuxPrevent loading of the vulnerable driver module
echo 'blacklist iosm' >> /etc/modprobe.d/blacklist.conf
rmmod iosm
🧯 If You Can't Patch
- Monitor system memory usage for abnormal consumption patterns
- Implement regular system reboots to clear accumulated memory leaks
🔍 How to Verify
Check if Vulnerable:
Check if IOSM driver is loaded: lsmod | grep iosm. If loaded and kernel version is unpatched, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel includes fix commit: git log --oneline | grep '128514b51a5ba2c82f9e4a106f1c10423907618a' or check kernel version against patched releases.📡 Detection & Monitoring
Log Indicators:
- Kernel oom-killer messages
- System memory exhaustion warnings in dmesg
- High memory usage without corresponding process allocation
Network Indicators:
- Unusual network device registration/unregistration patterns
SIEM Query:
source="kernel" AND ("Out of memory" OR "oom-killer" OR "memory allocation failure")