CVE-2022-28893

What it actually does

Use-after-free in the SUNRPC subsystem allows a local process to reference a freed xs_xprt structure after xs_xprt_free is called before sockets reach the intended state, enabling memory corruption.

Why it matters to the business

Attackers with local access on affected Linux systems can potentially gain elevated privileges or cause system instability, risking unauthorized access to data and services on servers and endpoints running vulnerable kernels.

How an attack unfolds

A local attacker interacts with SUNRPC transport sockets to trigger premature xs_xprt_free while references remain, then reuses the freed memory object to corrupt kernel structures and escalate privileges.

How to fix it

Update the Linux kernel to a version containing commit 1a3b1bba7c7a5eb8a11513cf88427cb9d77bc60a or later; apply the fix from the mainline repository and rebuild or install the patched package for the distribution in use.

How to confirm the fix worked

Verify the running kernel contains commit 1a3b1bba7c7a5eb8a11513cf88427cb9d77bc60a by inspecting /proc/version or kernel build logs; confirm SUNRPC transport handling no longer frees the structure prematurely through code review or testing socket state transitions.

Typical attack path

1. Obtain local unprivileged access on a target Linux system
2. Trigger SUNRPC socket operations that lead to xs_xprt_free without proper state checks
3. Reuse the dangling pointer to corrupt kernel memory
4. Escalate to root privileges or execute arbitrary kernel code

How to detect it

Review kernel logs and audit trails for unexpected SUNRPC transport errors or crashes around socket operations; examine system call traces involving RPC for signs of abnormal memory access patterns post-publication.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux systems within the next patching cycle
• Restrict local user access where feasible until patches are deployed
• Monitor for new kernel releases that backport the fix to supported distribution versions