CVE-2022-2873

What it actually does

Out-of-bounds memory access in the Linux kernel iSMT SMBus host controller driver when processing I2C_SMBUS_BLOCK_DATA via the I2C_SMBUS ioctl with malicious input, resulting in a kernel crash.

Why it matters to the business

Local denial-of-service that crashes affected Linux systems, interrupting workloads on servers and devices using the Intel iSMT SMBus controller; the flaw is old with low exploitability and no known ransomware use, limiting widespread operational risk.

How an attack unfolds

An attacker with local access on a vulnerable Linux kernel crafts a malicious I2C_SMBUS_BLOCK_DATA ioctl call to the iSMT driver, triggering the out-of-bounds access and forcing a system crash; no remote vector or code execution is possible.

How to fix it

Upgrade the Linux kernel to a version containing commit 3d7cb6b04c3f3115719235cc6866b10326de34cd or later; apply vendor-supplied kernel packages that include the fix for the iSMT driver.

How to confirm the fix worked

Verify the running kernel contains commit 3d7cb6b04c3f3115719235cc6866b10326de34cd; test that I2C_SMBUS_BLOCK_DATA ioctls no longer cause crashes under expected workloads.

Typical attack path

1. Gain local shell or process execution on a target Linux system
2. Invoke the I2C_SMBUS ioctl against the iSMT SMBus controller with crafted block data
3. Trigger kernel out-of-bounds access leading to panic or oops

How to detect it

Review kernel logs for oops or panic messages involving iSMT, SMBus, or I2C block data handling; correlate with processes issuing I2C ioctls around the time of the crash.

What your security team should do

• Identify systems exposing the iSMT SMBus driver and schedule kernel updates
• Monitor for kernel panics referencing SMBus or iSMT after patching
• Restrict unprivileged local access where feasible until kernels are updated