CVE-2022-2318

What it actually does

Use-after-free in the ROSE timer handler (net/rose/rose_timer.c) allows a local attacker to trigger kernel memory corruption resulting in a crash (denial of service).

Why it matters to the business

Unprivileged local users can cause Linux systems using the ROSE network stack to reboot or halt, producing unplanned downtime on affected hosts; the issue is narrowly scoped to the amateur-radio ROSE protocol but still requires kernel updates across the fleet.

How an attack unfolds

An attacker with a local account crafts or triggers timer events in the ROSE protocol stack; the freed timer structure is subsequently dereferenced inside the handler, producing a kernel oops and immediate system crash without needing elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 9cc02ede696272c5271a401e4f27c262359bc2f6 or later; rebuild and reboot all affected systems. Disable the ROSE protocol (CONFIG_ROSE=n) if it is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 9cc02ede696272c5271a401e4f27c262359bc2f6 or a later equivalent; attempt to load the rose module and exercise timer paths in a test environment to verify absence of the crash.

Typical attack path

1. Obtain a local shell on a Linux system that has the ROSE kernel modules loaded or compiled in
2. Trigger ROSE timer activity through network socket operations or module interaction
3. Cause the timer handler to reference already-freed memory
4. Kernel panics and the system becomes unavailable

How to detect it

Search kernel logs, dmesg output, and crash dumps for rose_timer references, use-after-free warnings, or oops traces mentioning net/rose/rose_timer.c; correlate with processes that open AF_ROSE sockets.

• rose_timer
• net/rose/rose_timer.c
• AF_ROSE
• use-after-free.*rose

What your security team should do

• Inventory all Linux distributions and custom kernels for the vulnerable rose_timer code path
• Apply the referenced upstream commit or distribution kernel update as soon as possible
• Restrict local accounts on systems where ROSE remains enabled until patched
• Monitor kernel crash logs for rose-related oops entries during the remediation window