CVE-2022-21814

What it actually does

Improper handling of permissions in the kernel driver package allows an unprivileged local user limited write access to protected memory, enabling denial of service conditions.

Why it matters to the business

Affected systems may experience unexpected crashes or service interruptions from local users, with low immediate risk given the 2022 disclosure, stable low exploit probability, and absence from known ransomware or threat actor campaigns.

How an attack unfolds

An attacker with existing local unprivileged access on an affected system leverages the permission flaw to perform limited writes into protected memory regions, resulting in denial of service; no named threat actors or campaigns have been observed exploiting this issue.

How to fix it

Upgrade gpac packages to the listed fixed versions: Debian 11 to 1.0.1+dfsg1-4+deb11u2, Ubuntu 22.04 LTS to 2.0.0+dfsg1-2, or GIT to commit 418db4149af78773815b5f6a7030a120037ba140; apply updates promptly despite low EPSS given the age of the issue.

How to confirm the fix worked

Verify package versions match the fixed releases above using distribution package managers, then confirm absence of the vulnerable code paths through source review or driver reload testing in a non-production environment.

Typical attack path

1. Gain local unprivileged shell or process execution on the target system
2. Trigger the kernel driver's insufficient permission checks to obtain limited write access to protected memory
3. Perform memory writes that induce denial of service or system instability

How to detect it

Review system and kernel logs for unexpected crashes or memory-related errors originating from local processes; correlate with user activity around the time of any denial-of-service events, noting the lack of known external indicators.

What your security team should do

• Prioritize patching gpac installations on Debian, Ubuntu, and GIT-based deployments to the specified fixed versions
• Audit local user access controls to reduce the pool of unprivileged accounts that could reach the driver
• Monitor EPSS and KEV updates for any future increase in exploit activity