CVE-2022-3635

What it actually does

Use-after-free condition in the tst_timer function of drivers/atm/idt77252.c triggered by concurrent manipulation of IPsec-related timers, enabling arbitrary kernel memory access.

Why it matters to the business

Local attackers can gain full control of affected Linux systems, leading to data theft, persistence, or ransomware deployment on servers and endpoints running vulnerable kernels.

How an attack unfolds

An attacker with local access crafts input to trigger a race in the ATM driver timer handling, frees an object while it remains referenced, then reuses the dangling pointer to execute code in kernel context.

How to fix it

Upgrade to a patched Linux kernel that removes the use-after-free in idt77252.c; apply vendor backports for distributions such as Debian; disable the ATM driver if unused via kernel configuration.

How to confirm the fix worked

Verify kernel source or binary no longer contains the vulnerable tst_timer logic, confirm updated package versions via package manager, and test that IPsec workloads no longer produce use-after-free warnings in kernel logs.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Load or interact with the idt77252 ATM driver under IPsec workload
3. Trigger the race condition via crafted timer operations
4. Perform heap grooming to control the freed object reuse
5. Execute arbitrary code with kernel privileges

How to detect it

Review kernel logs for use-after-free or slab corruption messages referencing idt77252 or tst_timer; inspect for unexpected process privilege escalations or new kernel modules following ATM/IPsec activity.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant systems
• Audit systems for idt77252 driver usage and blacklist if unnecessary
• Monitor EPSS trend and exploit availability for any increase in observed attempts
• Incorporate kernel crash and slab allocator logging into detection pipelines