CVE-2022-3545

What it actually does

Use-after-free in the area_cache_get function of drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c within the IPsec component of the Linux kernel, resulting in memory corruption.

Why it matters to the business

Local attackers may achieve kernel-level code execution on affected Linux systems, enabling full compromise, data theft, or service disruption; high prevalence across Debian distributions and NetApp storage appliances increases exposure for organizations relying on these platforms.

How an attack unfolds

An attacker with local access triggers the vulnerable IPsec path in the NFP driver to free memory that is later reused, allowing corruption of kernel structures for privilege escalation.

How to fix it

Apply upstream Linux kernel patches addressing the use-after-free in nfp_cppcore.c and update to fixed versions provided by distributions such as Debian; reboot systems after kernel upgrades and validate on NetApp hardware where applicable.

How to confirm the fix worked

Confirm kernel builds exclude the vulnerable area_cache_get implementation, review changelogs for the NFP driver fix, and perform regression testing on systems equipped with Netronome network cards.

Typical attack path

1. Gain local user access on a target Linux system
2. Invoke IPsec operations that exercise the NFP area_cache_get function
3. Trigger the use-after-free condition to corrupt kernel memory
4. Escalate privileges to achieve arbitrary code execution

How to detect it

Review kernel and syslog entries for NFP driver crashes or IPsec-related errors coinciding with suspicious local activity; inspect memory forensics for use-after-free artifacts in the nfp_cppcore module.

What your security team should do

• Expedite kernel updates across all Debian and NetApp Linux deployments
• Limit local user privileges on systems with IPsec or NFP hardware
• Audit logs for anomalous NFP driver activity
• Track EPSS trend and any emerging threat actor mentions for prioritization