CVE-2022-48670

What it actually does

Use-after-free in the PECI CPU auxiliary device release path: when auxiliary_device_add fails it triggers auxiliary_device_uninit which decrements the refcount and invokes adev_release; that function re-calls auxiliary_device_uninit, producing a refcount underflow and subsequent memory corruption.

Why it matters to the business

Local attackers on affected Linux kernels can crash systems or potentially execute arbitrary code with kernel privileges, leading to denial of service, data breaches, or full host compromise on servers and endpoints that load the peci driver.

How an attack unfolds

An attacker with local access crafts or triggers conditions that cause auxiliary_device_add to fail for the PECI CPU device, forcing the erroneous double-uninit path and resulting use-after-free; successful exploitation yields memory corruption that can be turned into arbitrary read/write or code execution.

How to fix it

Update the Linux kernel to a version containing commit c87f1f99e26ea4ae08cabe753ae98e5626bdba89 or later; rebuild and reboot with the patched kernel; if the peci driver is not required, blacklist the module as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel contains commit c87f1f99e26ea4ae08cabe753ae98e5626bdba89 or a backport; inspect dmesg or kernel logs for absence of the refcount underflow warning after device add failure injection; confirm peci module is not present or is the patched version via modinfo.

Typical attack path

1. Obtain local user access on a Linux system with the vulnerable peci driver loaded
2. Trigger auxiliary_device_add failure for the PECI CPU auxiliary device
3. Cause adev_release to execute the double auxiliary_device_uninit call
4. Exploit the resulting refcount underflow and use-after-free for memory corruption
5. Escalate to kernel code execution or system crash

How to detect it

Search kernel logs and dmesg for refcount underflow warnings originating from lib/refcount.c during peci device initialization; inspect crash dumps or KASAN reports for use-after-free in adev_release; correlate with process activity that interacts with PECI CPU auxiliary devices.

• refcount_t: underflow; use-after-free
• WARNING: CPU:.*at lib/refcount.c:.*refcount_warn_saturate
• adev_release

What your security team should do

• Prioritize kernel upgrades on all systems exposing the peci driver within the next patching cycle
• Monitor EPSS and exploit maturity indicators for any increase in public exploits
• Apply kernel live-patching where available for high-value assets
• Restrict local user access and module loading via LSM or modprobe blacklist until patched