CVE-2022-4382

What it actually does

Use-after-free condition in the gadgetfs Linux kernel driver caused by a race condition among superblock operations, triggered when a device is physically removed while gadgetfs is active.

Why it matters to the business

On Linux systems exposing gadgetfs (typically embedded or USB gadget configurations), an attacker with physical access could achieve kernel-level code execution or denial of service, potentially compromising the device or enabling further attacks; low likelihood given physical and timing requirements and lack of widespread exploitation.

How an attack unfolds

An attacker with physical access to the target device yanks the USB gadget hardware while gadgetfs superblock operations are in progress, winning the race to trigger the use-after-free and gain control of freed kernel memory.

How to fix it

Upgrade to a patched Linux kernel version that resolves the race condition in gadgetfs; if patching is not immediately possible, disable the gadgetfs driver or restrict physical access to affected devices.

How to confirm the fix worked

Verify the running kernel version against upstream fixes for gadgetfs superblock races; test device removal scenarios under load to confirm absence of the flaw; review kernel configuration to ensure gadgetfs is disabled where unnecessary.

Typical attack path

1. Gain physical access to the Linux device running gadgetfs
2. Ensure gadgetfs is actively mounted and performing superblock operations
3. Physically remove or disconnect the gadget device to trigger the race condition
4. Exploit the resulting use-after-free for memory corruption and code execution

How to detect it

Review kernel logs and dmesg output for gadgetfs-related oops or panic messages around device removal events; correlate with physical access logs; search for evidence of unexpected kernel memory corruption or exploitation attempts via crash dumps.

What your security team should do

• Prioritize kernel updates on any systems using gadgetfs, especially those with physical access exposure
• Disable gadgetfs module if the functionality is not required
• Enforce physical security controls around devices that may use gadget mode
• Monitor EPSS and exploit availability trends for any increase in risk