CVE-2022-3077

What it actually does

Local denial of service via kernel crash from buffer overflow in the iSMT SMBus host controller driver when processing malicious I2C_SMBUS_BLOCK_PROC_CALL data through the I2C_SMBUS ioctl.

Why it matters to the business

Unexpected system downtime and loss of availability on affected Linux systems, with recovery requiring reboots; low exploitability limits widespread impact but still poses operational risk in environments using the driver.

How an attack unfolds

A local attacker with access to the SMBus ioctl interface crafts input data for the I2C_SMBUS_BLOCK_PROC_CALL case that exceeds buffer bounds in the iSMT driver, triggering a kernel panic and crash.

How to fix it

Update the Linux kernel to a version containing commit 690b2549b19563ec5ad53e5c82f6a944d910086e which corrects the buffer handling in the iSMT driver; apply the fix across all affected distributions and verify the commit is present in the running kernel source.

How to confirm the fix worked

Confirm the kernel source includes commit 690b2549b19563ec5ad53e5c82f6a944d910086e, test the ioctl path with known-safe inputs to ensure no crash occurs, and review kernel build logs for the patched driver.

Typical attack path

1. Obtain local user access on the target Linux system
2. Locate the iSMT SMBus device exposed via /dev or sysfs
3. Prepare and issue a malicious I2C_SMBUS ioctl with BLOCK_PROC_CALL payload
4. Trigger buffer overflow leading to kernel panic and system crash

How to detect it

Review kernel logs for panic or oops entries referencing the iSMT SMBus driver or SMBus block processing failures; correlate with user activity on systems exposing the affected ioctl path.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems using the iSMT driver
• Restrict unprivileged access to SMBus ioctl interfaces where feasible via device permissions or LSM policies
• Include kernel oops and panic events in monitoring to detect potential exploitation attempts