CVE-2022-3565

What it actually does

Use-after-free in del_timer within drivers/isdn/mISDN/l1oip_core.c allows local code to reference freed timer structures in the Bluetooth ISDN layer, enabling memory corruption and potential privilege escalation to kernel level.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or obtain full control, leading to data theft, service disruption, or persistent compromise on servers and endpoints running the vulnerable kernel version.

How an attack unfolds

An attacker with local user privileges crafts input that triggers timer deletion races in the Bluetooth l1oip component; the freed timer object is later reused, allowing arbitrary kernel read/write or code execution.

How to fix it

Upgrade to a Linux kernel version containing the upstream patch for the del_timer use-after-free in l1oip_core.c; if no fixed version is available in your distribution, apply the vendor backport or disable the mISDN/l1oip Bluetooth driver via kernel configuration.

How to confirm the fix worked

Verify the running kernel source contains the fix for CVE-2022-3565 in drivers/isdn/mISDN/l1oip_core.c; confirm del_timer calls no longer reference potentially freed objects and test Bluetooth subsystem initialization under load.

Typical attack path

1. Obtain local shell access on target Linux system
2. Load or interact with Bluetooth ISDN subsystem to allocate timers
3. Trigger race condition in del_timer to free object while still referenced
4. Reuse dangling pointer for memory corruption or ROP to elevate privileges

How to detect it

Review kernel logs for oops/panic messages referencing l1oip_core.c or del_timer; inspect auditd or syslog entries showing unusual Bluetooth device attachment or timer-related crashes around the time of suspected activity.

What your security team should do

• Prioritize kernel updates on all multi-user or internet-facing Linux hosts
• Restrict local user accounts and Bluetooth functionality where possible
• Monitor for new kernel releases from distribution vendors and schedule rapid patching
• Consider runtime kernel protections such as SELinux or AppArmor to limit exploitation impact