CVE-2022-48762

What it actually does

Incorrect register index extraction in ex_handler_load_unaligned_zeropad() uses ex->type (always 4) instead of ex->data, forcing X0 as address register (arbitrary dereference) and X4 as data register (corruption), enabling kernel NULL pointer dereference or arbitrary behavior during exception fixup on arm64.

Why it matters to the business

Kernel crashes or memory corruption on arm64 systems can cause denial of service, data loss, or potential privilege escalation in affected Linux deployments, with higher urgency for organizations running unpatched kernels in production or high-availability environments.

How an attack unfolds

An attacker triggers a load_unaligned_zeropad() path that raises an exception (e.g., via crafted file operations or memory access), causing the faulty handler to dereference or corrupt registers and leading to a crash or undefined kernel behavior that may be leveraged for further exploitation.

How to fix it

Upgrade to Linux kernel 5.16.5 or later, or apply commit 47fe7a1c5e3e011eeb4ab79f2d54a794fdd1c3eb in the stable tree; rebuild and reboot affected arm64 systems.

How to confirm the fix worked

Confirm kernel version is at least 5.16.5 or contains commit 47fe7a1c5e3e; verify the fix by inspecting ex_handler_load_unaligned_zeropad() source to ensure ex->data is used for register extraction.

Typical attack path

1. Trigger unaligned memory load that invokes load_unaligned_zeropad()
2. Force exception entry into fixup_exception()
3. ex_handler_load_unaligned_zeropad() misreads register indices from ex->type
4. Dereference arbitrary address via X0 or corrupt X4
5. Result in kernel fault, crash, or attacker-controlled behavior

How to detect it

Search kernel logs for oops or NULL pointer dereference traces involving fixup_exception, load_unaligned_zeropad, or el1h_64_sync; look for crashes during path_openat or similar file operations on arm64 systems.

What your security team should do

• Prioritize patching arm64 Linux kernels to 5.16.5+ immediately
• Monitor for kernel oops or NULL dereference crashes in logs
• Test patches in staging before broad deployment
• Review downstream distributions for backported fixes