CVE-2022-4662

What it actually does

Incorrect access control in the Linux kernel USB core subsystem allows a local user attaching a USB device to trigger a kernel crash resulting in denial of service.

Why it matters to the business

Local users on affected Linux systems can cause repeated crashes and unplanned downtime; the issue affects the widely used Linux kernel with many downstream dependents though exploitation requires local access and remains low probability.

How an attack unfolds

An attacker with local shell access on a vulnerable Linux system attaches a specially crafted or malformed USB device that exercises the flawed access control path in the USB core, resulting in a kernel panic and system crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f or later; apply vendor-supplied kernel updates for all affected distributions.

How to confirm the fix worked

Verify the running kernel contains commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f or a later equivalent fix; test by attaching USB devices and confirming no kernel panic occurs.

Typical attack path

1. Obtain local user access on a target Linux system
2. Prepare or obtain a USB device that triggers the access control flaw
3. Attach the USB device to the running system
4. Observe kernel crash and denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for USB core subsystem errors or panic messages coinciding with USB device attachment events; correlate with user login sessions that have USB access.

• usbcore: failed to register the USB device
• kernel: [ 0.000000] usb
• Call Trace: usb_.*
• Kernel panic - not syncing: Fatal exception

What your security team should do

• Prioritize kernel updates on all Linux systems that accept USB input
• Apply the fix containing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f
• Consider USB device allow-listing or disabling unused USB ports where feasible until patched
• Monitor kernel logs for USB-related crashes as an interim detection measure