CVE-2022-48805

What it actually does

Out-of-bounds memory accesses in ax88179_rx_fixup allowing OOB reads of metadata arrays, packet overlaps causing endianness corruption of cloned SKBs, and construction of SKBs with tails beyond end, enabling kernel heap disclosure and potential OOB writes on little-endian systems.

Why it matters to the business

Linux systems using ax88179_178a USB Ethernet adapters on Debian 11/12/13 and Ubuntu 20.04 variants face risk of kernel memory leaks or corruption from malicious or defective USB devices, with high downstream prevalence increasing exposure across server and cloud workloads; 823 days since publication heightens urgency despite low EPSS.

How an attack unfolds

An attacker attaches a malicious USB device emulating the ax88179 adapter and transmits crafted packets that trigger out-of-bounds accesses during RX fixup, as demonstrated by sending bogus ICMPv6 Echo Requests that elicit replies containing random kernel heap data; threat actor references to Android Kernel RCE patterns suggest possible similar remote kernel exploitation vectors.

How to fix it

Upgrade affected packages to fixed versions: linux 5.10.103-1 on Debian 11, 5.16.10-1 on Debian 12 and 13, 5.4.0-9.12 on Ubuntu 20.04 LTS, 5.4.0-1005.5 on linux-aws, 5.15.0-1014.18~20.04.1 on linux-aws-5.15, and 5.4.0-1006.6 on linux-azure.

How to confirm the fix worked

Confirm running kernel version meets or exceeds the listed fixed versions for each distribution; test with ax88179 hardware using crafted packet sequences to verify absence of OOB behavior.

Typical attack path

1. Connect malicious or defective USB device presenting as ax88179_178a
2. Transmit specially crafted network packets to invoke ax88179_rx_fixup
3. Trigger OOB reads on metadata array or packet overlaps causing SKB corruption
4. Leak kernel heap contents via responses such as ICMPv6 or achieve OOB writes

How to detect it

Review kernel logs for ax88179_rx_fixup errors or anomalous SKB processing; inspect network traffic for unexpected ICMPv6 replies containing non-standard payload data; correlate with USB device connection events on systems running vulnerable kernels.

What your security team should do

• Apply listed kernel updates across all affected Debian and Ubuntu deployments without delay
• Restrict or disable ax88179_178a USB adapters where possible until patched
• Monitor for EPSS increases or new threat actor activity referencing similar kernel USB flaws