CVE-2022-0646

What it actually does

Use-after-free condition in the Linux kernel MCTP subsystem triggered when cancel_work_sync is called after unregister_netdev during device removal, allowing memory corruption that can lead to kernel crash or arbitrary code execution with elevated privileges.

Why it matters to the business

Local attackers on affected systems can cause denial of service through crashes or gain full control of the host, disrupting operations and potentially exposing sensitive data across Linux-based infrastructure and dependent appliances.

How an attack unfolds

An attacker with local access loads or triggers the MCTP serial device path introduced in early 5.17 kernels, unregisters the network device, and races cancel_work_sync to trigger the use-after-free for privilege escalation or system crash.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the MCTP use-after-free (post 5.17-rc5) on all affected hosts and NetApp appliances; apply vendor firmware updates where available and disable MCTP if not required.

How to confirm the fix worked

Confirm kernel version is newer than 5.17-rc5 on each system, verify MCTP module is either absent or the vulnerable code paths have been removed via source inspection or vendor patch notes, and test device removal under load to ensure no crashes occur.

Typical attack path

1. Obtain local shell access on a vulnerable Linux kernel (5.17-rc1 through rc5)
2. Trigger MCTP device registration and subsequent unregister_netdev
3. Invoke cancel_work_sync in a timing window to exploit the freed memory
4. Leverage resulting corruption for kernel code execution or denial of service

How to detect it

Review kernel logs for MCTP-related oops or use-after-free warnings during device removal events; inspect audit logs for unexpected privilege changes or crashes on systems running 5.17-rc series kernels; correlate with local user activity around network device unload operations.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-user Linux systems within the next maintenance window
• Inventory all NetApp storage appliances listed as affected and schedule firmware updates
• Restrict local user access and consider disabling unused MCTP functionality via kernel configuration
• Monitor for new exploit code given the 1704-day publication window