CVE-2022-48771

What it actually does

A failed usercopy of the fence_rep object in vmwgfx leaves a stale file descriptor because put_unused_fd is not invoked, allowing userland to retain a reference to a dangling file object and trigger use-after-free conditions.

Why it matters to the business

Attackers can achieve local privilege escalation or kernel code execution on systems running the affected kernel versions, potentially compromising the entire host; the low EPSS and absence from KEV indicate limited in-the-wild exploitation so far, but the kernel's ubiquity still warrants prompt patching.

How an attack unfolds

An attacker triggers the vmwgfx fence_rep usercopy path, forces the copy to fail, retains the still-valid file descriptor, then reuses it to access the freed file object and construct a use-after-free exploit chain for arbitrary kernel read/write or code execution.

How to fix it

Upgrade the Linux kernel to the commit e8d092a62449dcfc73517ca43963d2b8f44d0516 or later stable releases that contain the fix deferring fd_install until after a successful usercopy.

How to confirm the fix worked

Confirm the running kernel contains commit e8d092a62449dcfc73517ca43963d2b8f44d0516 or a backport that moves fd_install after the usercopy succeeds; review kernel build logs and /proc/version for the updated commit hash.

Typical attack path

1. Identify a process or ioctl path that exercises the vmwgfx fence_rep usercopy
2. Force the usercopy operation to fail
3. Retain the file descriptor that was never cleaned up
4. Reuse the descriptor to reference the dangling file object
5. Trigger use-after-free primitives to corrupt kernel memory or redirect execution

How to detect it

Search kernel logs and audit trails for repeated failures in vmwgfx fence operations followed by unexpected file descriptor reuse; examine crash dumps for use-after-free signatures in the drm/vmwgfx path.

What your security team should do

• Apply the kernel update containing commit e8d092a62449dcfc73517ca43963d2b8f44d0516 to all affected systems within standard change windows
• Prioritize systems exposing the vmwgfx driver to untrusted local users
• Monitor vendor advisories for distribution-specific backports