CVE-2022-48786

What it actually does

Signal interruption during vsock_connect() leaves the socket in the connected table without removal on state reset, enabling duplicate addition on retry and corrupting the list structure.

Why it matters to the business

Systems relying on vsock (virtual sockets for containers/VMs) may experience crashes, instability, or memory corruption; the issue affects Debian 12 chromium packages with many downstream dependents increasing exposure risk, though no active KEV or ransomware use reported.

How an attack unfolds

An attacker sends a signal to interrupt vsock_connect() while the socket is in TCP_ESTABLISHED, then retries the connection to trigger double-add corruption; listed threat actors reference related kernel UAF/RCE patterns that could chain from this race condition.

How to fix it

Upgrade affected chromium packages on Debian 12 to 126.0.6478.114-1~deb12u1 or later; backport requires prerequisite patch d5afa82c977e; apply kernel updates addressing vsock removal logic.

How to confirm the fix worked

Confirm package version matches or exceeds fixed chromium release; verify vsock socket handling no longer permits double-add after signal interruption via code review or targeted testing.

Typical attack path

1. Trigger signal-pending state during vsock connection attempt
2. Allow socket to remain in connected table without removal
3. Retry connect() to cause duplicate list entry and corruption
4. Exploit resulting memory inconsistency for further impact

How to detect it

Review kernel logs for vsock list corruption warnings or crashes during connect; examine process signals and socket state transitions around connection attempts; threat actor references suggest looking for patterns seen in kernel UAF exploits.

What your security team should do

• Prioritize upgrade of chromium on Debian 12 to fixed version immediately due to 823 days since publication
• Audit vsock usage in container/VM environments for exposure
• Monitor EPSS trend (stable at 0.0025) and re-evaluate if new exploits emerge
• Test backported kernel fixes in non-production environments