CVE-2022-3625

What it actually does

Use-after-free in devlink_param_set/devlink_param_get in net/core/devlink.c IPsec component leads to memory corruption with local high-impact primitives.

Why it matters to the business

Local attackers could achieve code execution or denial of service on unpatched Linux systems; low EPSS, no KEV or ransomware usage, and 1458 days since disclosure reduce urgency but remaining exposures still require remediation.

How an attack unfolds

An attacker with local low-privileged access supplies crafted parameters to the devlink IPsec functions, triggering a use-after-free that can be leveraged for arbitrary code execution or system instability; generic Linux kernel use-after-free techniques noted by threat actors.

How to fix it

Apply upstream Linux kernel patch fixing the devlink use-after-free; for firefly-iii/firefly-iii (GIT) update to commit a85b6420c19ace35134f896e094e1971d8c7954b.

How to confirm the fix worked

Confirm kernel source contains the devlink.c fix or verify package version against fixed commit; test that devlink_param operations no longer produce use-after-free under fuzzing.

Typical attack path

1. Gain local shell or process execution on target Linux host
2. Locate and interact with devlink IPsec parameter interfaces
3. Trigger use-after-free via parameter set/get manipulation
4. Weaponize freed object for privilege escalation or crash

How to detect it

Review kernel logs and audit trails for devlink_param errors or suspicious IPsec parameter activity; correlate with known Linux kernel use-after-free patterns from threat actors.

What your security team should do

• Patch all Linux kernels to the fixed version immediately if still vulnerable
• Harden local access controls and reduce unnecessary privileges on hosts running IPsec
• Add kernel memory-safety monitoring and watch for devlink-related crashes