CVE-2022-34495

What it actually does

Double-free condition in rpmsg_probe allows local attackers to corrupt kernel memory structures, leading to denial of service via panic or potential privilege escalation within the kernel address space.

Why it matters to the business

Local users or compromised processes can trigger system instability or crashes, causing unplanned downtime on Linux hosts and possible full host compromise if chained with other flaws.

How an attack unfolds

An attacker with local access supplies crafted input that reaches the rpmsg bus driver, causing the probe routine to free the same allocation twice and corrupt kernel heap metadata.

How to fix it

Upgrade the Linux kernel to a version containing commit c2eecefec5df1306eafce28ccdf1ca159a552ecc; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel source contains the referenced commit or check kernel version strings against distributions that backported the fix; test rpmsg device attachment under load to confirm absence of panic.

Typical attack path

1. Obtain local shell or process execution on the target Linux system
2. Interact with or load a virtio rpmsg device to invoke the probe path
3. Trigger the double-free condition to corrupt memory and achieve denial of service or code execution

How to detect it

Review kernel logs and dmesg output for repeated oops, panic, or slab corruption messages involving rpmsg or virtio_rpmsg_bus; correlate with process activity that loads or probes rpmsg devices.

What your security team should do

• Apply the kernel update containing the referenced commit as soon as possible on all affected hosts
• Limit untrusted local code execution and restrict access to virtio or rpmsg device nodes
• Monitor kernel logs for oops or panic entries referencing virtio_rpmsg_bus