CVE-2022-3977

What it actually does

Use-after-free in Linux kernel MCTP implementation triggered when DROPTAG ioctl races with socket close, allowing arbitrary memory access by a local process.

Why it matters to the business

Local attackers can crash affected systems or obtain elevated privileges, resulting in denial of service or full host compromise on Linux deployments that use MCTP.

How an attack unfolds

An attacker with a local account opens an MCTP socket, issues the DROPTAG ioctl while simultaneously closing the socket to trigger the race, then leverages the resulting dangling pointer to corrupt kernel memory and escalate privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 3a732b46736cd8a29092e4b0b1a9ba83e672bf89 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 3a732b46736cd8a29092e4b0b1a9ba83e672bf89 via git log or kernel version string; test that simultaneous DROPTAG and close no longer produce use-after-free warnings in kernel logs.

Typical attack path

1. Obtain local shell on target Linux system
2. Open MCTP socket via AF_MCTP
3. Trigger concurrent DROPTAG ioctl and close(2) to induce use-after-free
4. Use freed object for kernel memory corruption
5. Escalate to root or cause kernel panic

How to detect it

Review kernel logs for oops/panic messages mentioning mctp or use-after-free; inspect auditd or syscall logs for unusual ioctl activity on AF_MCTP sockets around crash times.

What your security team should do

• Apply the referenced kernel commit or newer distribution kernel immediately on all MCTP-enabled systems
• Prioritize patching internet-facing or multi-tenant hosts first due to local privilege-escalation risk
• Disable MCTP functionality where not required until patches are deployed
• Monitor for kernel oops or panic events referencing mctp