CVE-2022-48774

What it actually does

Incorrect goto ordering and dev_err placement in pt_core_init error paths cause resource leaks and attempts to release unallocated objects in the ptdma DMA engine.

Why it matters to the business

Kernel DMA subsystems on affected Linux distributions may experience instability, memory exhaustion, or corruption that disrupts device drivers and system operations; widespread package presence increases exposure across server and cloud fleets.

How an attack unfolds

An attacker with local access triggers the pt_core_init error path through crafted DMA operations or device initialization; the flawed cleanup sequence leaks or mishandles kernel resources, enabling memory corruption that can be leveraged for privilege escalation.

How to fix it

Upgrade linux packages to the following fixed versions: Debian 11 to 5.10.92-1, Debian 12/13 to 5.15.15-1, Ubuntu 20.04 LTS variants (linux-aws-5.15, linux-azure-5.15, etc.) to the listed 5.15.0 or 5.4.0 point releases, and Ubuntu 22.04 LTS linux/linux-aws to 5.15.0-17.17 or later.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed package versions for each distribution; inspect dmesg and kernel logs for absence of pt_core_init resource warnings after driver load.

Typical attack path

1. Obtain local execution on a vulnerable Linux system
2. Trigger DMA engine initialization that hits an error path in pt_core_init
3. Exploit resulting resource leak or premature release to corrupt kernel memory
4. Escalate privileges or achieve code execution within the kernel

How to detect it

Review kernel ring buffer and syslog for pt_core_init error messages or resource allocation warnings; correlate with process crashes or unexpected DMA driver reloads on systems running vulnerable kernels.

What your security team should do

• Apply the listed kernel package updates immediately on all affected Debian and Ubuntu systems
• Prioritize patching for internet-facing or high-value hosts given the memory-corruption family
• Monitor EPSS and KEV status for any future increase in exploit activity