CVE-2022-1943

What it actually does

Out-of-bounds memory write in the Linux kernel UDF filesystem implementation triggered via udf_write_fi() during user-initiated file operations.

Why it matters to the business

Allows local attackers to crash Linux systems or potentially escalate privileges on any system that mounts or interacts with UDF-formatted media; low EPSS and absence from KEV indicate limited real-world exploitation pressure despite the 1599-day exposure window.

How an attack unfolds

A local attacker with standard user privileges crafts or accesses a UDF filesystem image and performs file operations that invoke udf_write_fi(), resulting in an out-of-bounds write that can lead to denial of service or arbitrary code execution.

How to fix it

Apply a kernel update containing commit c1ad35dd0548ce947d97aaf92f7f2f9a202951cf from the mainline Linux repository.

How to confirm the fix worked

Confirm the running kernel source tree includes commit c1ad35dd0548ce947d97aaf92f7f2f9a202951cf or later; test with crafted UDF images under controlled conditions.

Typical attack path

1. Gain local shell access on a Linux host
2. Prepare or mount a malicious UDF filesystem image
3. Trigger file operations that call udf_write_fi()
4. Exploit the resulting out-of-bounds write for crash or privilege escalation

How to detect it

Review kernel logs for UDF-related oops or panic entries and monitor for unexpected process crashes when UDF filesystems are accessed.

What your security team should do

• Prioritize kernel upgrades to include the referenced commit on all Linux systems
• Limit untrusted local user access to UDF media until patched
• Track upstream kernel advisories for backported fixes in distribution kernels