CVE-2022-48769

What it actually does

The kernel unconditionally invokes EFI v2.0 runtime services such as QueryVariableInfo() on Apple x86 systems whose firmware only implements EFI v1.10, triggering an immediate firmware crash during variable-space queries.

Why it matters to the business

Linux workloads running on Apple Mac hardware can experience sudden system halts or boot failures when the kernel attempts normal EFI variable operations, forcing unplanned downtime and hardware-specific troubleshooting.

How an attack unfolds

An attacker or automated process that causes the kernel to query or set EFI variables (for example during boot or package updates) on an affected Apple x86 machine triggers the unsupported EFI v2 call, resulting in firmware-level denial of service. The issue is triggered by legitimate kernel behavior rather than malicious payload delivery.

How to fix it

Upgrade the Linux kernel to a build that includes commit b0f1cc093bc2493ac259c53766fd2b800e085807 (or the equivalent stable-tree backport) so that EFI v2 services are skipped on Apple x86 platforms.

How to confirm the fix worked

Confirm the running kernel contains the listed commit hash; perform EFI variable read/write operations on Apple hardware and verify no firmware crash occurs.

Typical attack path

1. Boot or run a vulnerable kernel on Apple x86 hardware
2. Kernel invokes QueryVariableInfo() or similar EFI v2 service
3. Apple firmware, limited to EFI v1.10, crashes
4. System becomes unresponsive or reboots

How to detect it

Search kernel and firmware logs on Apple x86 systems for entries mentioning EFI runtime services, QueryVariableInfo, or unexpected firmware resets during variable operations.

What your security team should do

• Apply the kernel update containing b0f1cc093bc2493ac259c53766fd2b800e085807 on all Apple x86 Linux systems within the next maintenance window
• Add Apple hardware to the inventory of systems requiring kernel version checks
• Test EFI variable handling in lab Apple machines after patching