CVE-2022-48672

What it actually does

Off-by-one error in unflatten_dt_nodes() allows overflow of the nps[] buffer during device tree unflattening due to an incomplete depth check fix.

Why it matters to the business

Local attackers can gain elevated privileges or crash systems, risking unauthorized access to sensitive data and operational disruption on affected devices.

How an attack unfolds

An attacker with local access supplies a malicious device tree blob that triggers excessive recursion depth, overflowing the buffer in the kernel's device tree parsing routine during boot or device initialization.

How to fix it

Update to fixed kernel versions containing commit cbdda20ce363356698835185801a58a28f644853; apply package updates such as libheif 1.16.2-1 on Debian 13, 1.6.1-1ubuntu0.1~esm1 on Ubuntu Pro 20.04 LTS, 1.17.6-1ubuntu4 on Ubuntu 24.04 LTS, and 1.12.0-2ubuntu0.1~esm1 on Ubuntu Pro 22.04 LTS.

How to confirm the fix worked

Confirm presence of the fix commit in the kernel source or verify updated package versions; test device tree loading with boundary-case depth values.

Typical attack path

1. Obtain local system access
2. Craft and load a malicious flattened device tree via bootloader or initramfs
3. Trigger device tree unflatten operation during kernel startup or probe
4. Leverage buffer overflow for privilege escalation or denial of service

How to detect it

Search kernel logs for device tree parsing errors, buffer overflow indicators, or crashes during unflatten_dt_nodes execution; monitor for unexpected device tree modifications at boot.

What your security team should do

• Prioritize kernel and package updates on all affected systems
• Limit local unprivileged access to reduce attack surface
• Review bootloader and initramfs configurations for device tree sources