CVE-2022-3636

What it actually does

Use-after-free in __mtk_ppe_check_skb within the MediaTek PPE Ethernet handler that leaves a freed skb object accessible for subsequent operations, enabling memory corruption.

Why it matters to the business

May allow local attackers to crash systems or execute code with elevated privileges on Linux servers and devices using affected MediaTek Ethernet hardware, leading to service outages and unplanned maintenance.

How an attack unfolds

An attacker with local access sends specially crafted network frames that reach the vulnerable MediaTek PPE path, triggers the use-after-free during skb processing, then leverages the dangling pointer for arbitrary read/write to achieve code execution.

How to fix it

Apply the official patch to drivers/net/ethernet/mediatek/mtk_ppe.c or install a kernel update that resolves the use-after-free; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the mtk_ppe.c source for the corrected skb handling logic and verify the running kernel version contains the fix.

Typical attack path

1. Obtain local shell or user access on the target host
2. Prepare and transmit network traffic that exercises the mtk_ppe code path
3. Trigger double-free or dangling reference during __mtk_ppe_check_skb
4. Corrupt kernel memory structures to escalate privileges or execute payload

How to detect it

Review kernel logs for oops or panic messages referencing mtk_ppe.c or skb use-after-free conditions; correlate with unexpected network interface resets.

What your security team should do

• Patch or replace vulnerable kernels on all MediaTek Ethernet systems within 30 days
• Limit local unprivileged accounts and network namespaces on exposed hosts
• Enable kernel hardening features such as KASAN or hardened usercopy where available