CVE-2022-48804

What it actually does

Improper ordering of decrement and array_index_nospec sanitization in vt_setactivate allows a transient integer underflow, causing an out-of-bounds value to be used on the speculative path and enabling potential memory corruption.

Why it matters to the business

Attackers who already have local access on affected Linux systems can attempt to corrupt kernel memory, leading to privilege escalation, system instability, or denial of service on servers, desktops, and cloud instances running the listed kernel packages.

How an attack unfolds

An attacker with local access invokes the vt_ioctl interface with a crafted VT_SETACTIVATE argument that triggers the underflow after the nospec barrier, then uses the resulting transient out-of-bounds value to read or write kernel memory via speculative execution gadgets.

How to fix it

Upgrade to a fixed kernel version: Debian 11/12/13 to 5.10.103-1 or 5.16.10-1, mainline Linux to 5.10.99, and the listed Ubuntu 20.04/22.04 packages to the corresponding 5.15.0-*-* fixed builds; reboot after installation.

How to confirm the fix worked

Verify running kernel version against the fixed package list for the distribution; confirm absence of the vulnerable vt_setactivate code path via source inspection or distro advisory matching.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Open /dev/tty or equivalent console device
3. Call ioctl with VT_SETACTIVATE using a value that causes post-nospec decrement underflow
4. Combine with speculative gadget to achieve arbitrary read/write or code execution in kernel context

How to detect it

Review kernel audit logs and dmesg for unusual vt_ioctl calls or console activation attempts; correlate with process execution of binaries invoking VT_SETACTIVATE; no public exploit artifacts are known at publication time.

What your security team should do

• Prioritize patching internet-facing or multi-tenant systems within the next maintenance window
• Apply kernel updates via standard package manager and schedule reboots
• Restrict unprivileged ioctl access to console devices where feasible using LSM policies
• Monitor EPSS and exploit maturity for any future increase in public tooling