CVE-2022-0494

What it actually does

The flaw in scsi_ioctl permits a local process holding CAP_SYS_ADMIN or CAP_SYS_RAWIO to read kernel memory contents that should remain inaccessible, resulting in an information disclosure.

Why it matters to the business

Organizations running affected Linux kernels face a risk of kernel memory exposure on systems where administrators or privileged services already hold the required capabilities; the issue has been public for over four years with no observed exploitation or ransomware use, lowering immediate urgency but still requiring patching of all deployed kernels.

How an attack unfolds

An attacker first obtains a process with CAP_SYS_ADMIN or CAP_SYS_RAWIO, then issues a specially crafted SCSI ioctl request that triggers the uninitialized or out-of-bounds read inside scsi_ioctl, receiving the leaked kernel data back to user space.

How to fix it

Upgrade the Linux kernel to a version that includes commit f443e374ae131c168a065ea1748feac6b2e76613; rebuild and reboot all affected systems; restrict CAP_SYS_ADMIN and CAP_SYS_RAWIO to the minimum set of processes.

How to confirm the fix worked

Verify that the running kernel contains commit f443e374ae131c168a065ea1748feac6b2e76613 or a later equivalent fix; confirm the vulnerable scsi_ioctl path is no longer reachable by re-testing the ioctl behavior under the same capabilities.

Typical attack path

1. Gain a shell or process with CAP_SYS_ADMIN or CAP_SYS_RAWIO on the target host
2. Prepare and invoke a malicious SCSI ioctl call against a block device
3. Receive and exfiltrate the leaked kernel memory contents

How to detect it

Review system call audit logs for unusual SCSI ioctl invocations from processes holding CAP_SYS_ADMIN or CAP_SYS_RAWIO; correlate with any subsequent unexpected outbound transfers of data originating from kernel address space.

What your security team should do

• Prioritize kernel updates on all internet-facing or multi-tenant Linux hosts
• Audit which services currently run with CAP_SYS_ADMIN or CAP_SYS_RAWIO and reduce that footprint
• Monitor upstream kernel changelogs for any related backports to long-term support branches