CVE-2022-34494

What it actually does

Double-free vulnerability in rpmsg_virtio_add_ctrl_dev allows a local attacker to corrupt kernel memory structures, leading to a kernel panic or denial of service.

Why it matters to the business

Linux systems using affected kernels may experience unexpected crashes and service interruptions when the vulnerable code path is exercised, increasing downtime and operational overhead until systems are updated.

How an attack unfolds

An attacker with local access crafts input or loads a module that reaches rpmsg_virtio_add_ctrl_dev, triggering the double-free condition and causing the kernel to panic.

How to fix it

Upgrade the Linux kernel to version 5.18.4 or later; apply the fix from commit 1680939e9ecf7764fba8689cfb3429c2fe2bb23c. Reboot after installation and verify the running kernel version.

How to confirm the fix worked

Confirm the installed kernel is 5.18.4 or newer using uname -r; inspect source or package manifests for the presence of the referenced commit. Test affected rpmsg paths in a lab environment to ensure stability.

Typical attack path

1. Obtain local shell or user access on a vulnerable Linux system
2. Trigger rpmsg virtio control device registration through module load or device interaction
3. Induce the double-free condition in drivers/rpmsg/virtio_rpmsg_bus.c
4. Cause kernel memory corruption resulting in panic or system halt

How to detect it

Search kernel logs for oops, panic, or double-free warnings referencing virtio_rpmsg_bus.c or rpmsg_virtio_add_ctrl_dev around the time of system instability; correlate with local user activity or module loads.

What your security team should do

• Prioritize kernel updates on all affected Linux hosts within standard maintenance windows
• Review kernel configurations to disable unused rpmsg or virtio drivers where feasible
• Monitor for kernel oops or panic logs indicating memory corruption in virtio_rpmsg_bus
• Include the fix in automated patch pipelines and golden images