CVE-2022-48638

What it actually does

The cgroup_get_from_id() function fails to verify that the kernfs node corresponding to a provided cgroup ID is a directory, allowing invalid input to trigger a kernel panic.

Why it matters to the business

Attackers with the ability to supply cgroup identifiers can crash the system, leading to denial of service and potential loss of availability for services running on the affected Linux systems.

How an attack unfolds

An attacker with local access crafts a userspace-provided cgroup ID that resolves to a non-directory kernfs node and passes it to cgroup_get_from_id(), causing the kernel to panic due to incorrect assumptions about the node type.

How to fix it

Apply the kernel patch from commit 8484a356cee8ce3d6a8e6266ff99be326e9273ad or update to a Linux kernel version that includes this fix.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source or test by attempting to reproduce the panic condition on patched systems.

Typical attack path

1. Obtain local access to the system
2. Identify or create a non-directory kernfs node
3. Invoke cgroup operations with a crafted ID pointing to that node
4. Trigger kernel panic

How to detect it

Examine system logs for kernel oops or panic messages mentioning cgroup or kernfs, and audit userspace applications that interact with cgroup IDs for anomalous behavior.

What your security team should do

• Prioritize patching affected Linux kernels
• Monitor for kernel panics related to cgroup handling
• Restrict unprivileged access to cgroup interfaces where possible