CVE-2022-48674

What it actually does

Use-after-free in erofs pcluster handling on UP platforms (CONFIG_SMP disabled) due to erofs_workgroup_unfreeze not resetting orig_val, allowing reuse of freed structures before RCU grace period completes and leading to memory corruption via mutex operations in z_erofs paths.

Why it matters to the business

Unpatched kernels on single-CPU Linux systems using erofs may experience crashes or memory corruption during filesystem operations, increasing downtime risk and potential for local privilege escalation on affected servers or embedded devices.

How an attack unfolds

An attacker with local access triggers erofs read-ahead or page operations under memory pressure to race the shrinker path, causing a freed pcluster to be reused and corrupt kernel state during mutex acquisition.

How to fix it

Upgrade the Linux kernel to commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; disable erofs if unused; apply distribution backports for supported releases.

How to confirm the fix worked

Verify kernel source contains the fix commit; run KASAN-enabled stress tests with CONFIG_SMP=n exercising erofs read and shrink paths; confirm no use-after-free reports in dmesg.

Typical attack path

1. Obtain local unprivileged access on target Linux system
2. Mount or access erofs filesystem images while triggering slab pressure
3. Invoke operations that call z_erofs_readahead and erofs_shrink_scan concurrently
4. Exploit resulting use-after-free for arbitrary read/write or code execution

How to detect it

Review kernel logs for KASAN use-after-free reports involving __mutex_lock and z_erofs_do_read_page; inspect RCU and shrinker activity around erofs_shrink_workstation calls.

What your security team should do

• Prioritize kernel updates on all single-CPU or embedded systems using erofs within 30 days
• Audit workloads for erofs usage and restrict to trusted images
• Enable kernel hardening options such as CONFIG_SLAB_FREELIST_RANDOM and KASAN in test environments
• Monitor for erofs-related kernel panics in logs