CVE-2022-48782

What it actually does

Use-after-free in Linux kernel MCTP route handling where a freed key object is accessed via trace_mctp_key_acquire after mctp_key_add failure.

Why it matters to the business

May cause kernel instability, crashes, or memory corruption on Linux systems using MCTP networking, leading to downtime or potential privilege escalation in high-privilege contexts.

How an attack unfolds

An attacker triggers the error path in mctp_key_add during MCTP route operations, causing the key to be freed yet subsequently referenced in the trace point, enabling use-after-free exploitation for memory corruption or code execution.

How to fix it

Update the Linux kernel to a version containing commit 1dd3ecbec5f606b2a526c47925c8634b1a6bb81e or later stable release that resolves the MCTP route.c issue.

How to confirm the fix worked

Verify kernel source or binary includes the referenced commit; recompile and test MCTP key addition failure paths to confirm absence of the static analysis warning and use-after-free condition.

Typical attack path

1. Obtain local or network-adjacent access to trigger MCTP key addition
2. Force failure condition in mctp_key_add
3. Trigger trace_mctp_key_acquire on the now-freed key
4. Leverage resulting use-after-free for memory manipulation or control flow hijack

How to detect it

Inspect kernel logs for MCTP trace or oops messages referencing route.c or key acquire after free; correlate with processes performing MCTP route operations.

What your security team should do

• Apply kernel updates containing the fix to all affected Linux distributions promptly
• Monitor upstream stable kernel releases for backports
• Restrict MCTP usage to trusted environments until patched
• Review system logs for MCTP-related oops or warnings as interim detection