CVE-2022-3541

What it actually does

Use-after-free memory corruption triggered by manipulation of the spl2sw_nvmem_get_mac_address function in the Sunplus Ethernet driver within the BPF subsystem of the Linux kernel.

Why it matters to the business

Local attackers on affected Linux systems can achieve arbitrary code execution with kernel privileges, leading to full host compromise, data theft, or denial of service; the vulnerability has been public for over four years with no fixed versions listed and low but slowly rising exploit probability.

How an attack unfolds

An attacker with local access crafts input or timing to trigger the use-after-free condition in the network driver function, allowing reuse of freed memory for kernel-level code execution.

How to fix it

Apply the upstream patch referenced in VDB-211041 or upgrade to a Linux kernel version that resolves the use-after-free in drivers/net/ethernet/sunplus/spl2sw_driver.c; monitor vendor backports for distributions still shipping the affected driver.

How to confirm the fix worked

Verify the presence of the fix by inspecting the spl2sw_driver.c source for proper memory handling around nvmem_get_mac_address, confirm updated kernel versions via uname or package manager, and test that the driver no longer exhibits use-after-free under local access scenarios.

Typical attack path

1. Obtain local user access on a vulnerable Linux host
2. Trigger the spl2sw_nvmem_get_mac_address function through network or BPF operations
3. Exploit the resulting use-after-free to corrupt kernel memory
4. Escalate to root privileges or execute arbitrary kernel code

How to detect it

Review kernel logs for use-after-free warnings or panics involving spl2sw_driver or BPF operations; correlate with local user activity and network driver initialization events.

What your security team should do

• Prioritize kernel updates on all systems exposing the Sunplus Ethernet driver
• Restrict local user access and BPF capabilities where possible until patched
• Monitor EPSS trend and kernel mailing lists for any increase in exploit maturity