CVE-2022-1462

What it actually does

Out-of-bounds read in the Linux kernel TTY subsystem triggered by a race condition involving ioctls TIOCSPTLCK, TIOCGPTPEER, TIOCSTI, and TCXONC, resulting in memory disclosure or system crash via flush_to_ldisc.

Why it matters to the business

Local attackers on affected Linux systems can cause denial of service through crashes or leak sensitive memory contents, increasing risk of further compromise on servers, workstations, and embedded devices that rely on the kernel TTY layer.

How an attack unfolds

An attacker with local access crafts a program that concurrently invokes the listed ioctls to win the race condition in the TTY subsystem, causing the kernel to read beyond allocated buffers in flush_to_ldisc and either panic the system or return arbitrary kernel memory to user space.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the TTY race condition; apply the latest security updates from the distribution vendor for all affected releases of Red Hat Enterprise Linux and Debian.

How to confirm the fix worked

Verify the running kernel version is newer than the vulnerable release, confirm the patch is present by inspecting the flush_to_ldisc function for the added synchronization, and test that the specific ioctl race no longer produces memory leaks or crashes.

Typical attack path

1. Obtain local unprivileged shell on target Linux system
2. Compile and execute a userspace program that opens a pseudoterminal and races TIOCSPTLCK with TIOCGPTPEER while issuing TIOCSTI and TCXONC
3. Trigger the race repeatedly until memory disclosure or kernel panic occurs
4. If disclosure succeeds, parse leaked data for credentials, pointers, or other sensitive values to escalate privileges

How to detect it

Review kernel logs for TTY-related oops or panic messages containing flush_to_ldisc, inspect auditd or syslog for unusual ioctl activity on ptmx or pts devices, and correlate with process execution of untrusted local binaries.

• flush_to_ldisc
• TIOCSPTLCK
• TIOCGPTPEER
• TIOCSTI
• TCXONC
• kernel: TTY: possible memory corruption

What your security team should do

• Apply kernel security updates immediately on all internet-facing and multi-user systems
• Restrict local user accounts and limit use of pseudoterminals where feasible
• Monitor for kernel oops or panic events involving the TTY subsystem
• Reboot systems after kernel upgrades to load the patched code