CVE-2022-3239

What it actually does

Use-after-free in em28xx_usb_probe() of the video4linux driver allows local memory corruption after probe completion, enabling system crash or privilege escalation.

Why it matters to the business

Local users on Linux systems with Empia 28xx TV cards can crash hosts or gain root, leading to downtime or full system compromise; low prevalence limits widespread risk but kernel updates remain essential for affected devices.

How an attack unfolds

A local attacker loads or triggers the em28xx driver probe for compatible TV cards, frees an object while it remains referenced, then reuses the dangling pointer to corrupt kernel memory and escalate privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel source contains commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d, verify running kernel version matches the fixed release, and test that em28xx probe no longer triggers the flaw.

Typical attack path

1. Gain local shell access on target Linux host
2. Trigger em28xx_usb_probe via device insertion or module load
3. Trigger use-after-free through crafted probe sequence
4. Leverage freed object reuse for kernel memory corruption
5. Escalate to root or cause denial of service

How to detect it

Review kernel logs and dmesg for video4linux or em28xx driver crashes and privilege-escalation indicators around the time of local user activity.

• em28xx_usb_probe
• use after free.*video4linux
• em28xx.*probe

What your security team should do

• Apply the referenced kernel commit or newer release to all affected systems
• Restrict local device access for untrusted users until patched
• Monitor kernel logs for video4linux crashes and escalate patching priority if local access is broadly granted