CVE-2022-48807

What it actually does

Mismatched netdev notifier handler for NETDEV_UNREGISTER events in the Linux kernel LAG/bonding code leads to invalid structure access and KASAN-detected stack-out-of-bounds read/write.

Why it matters to the business

Linux systems using network bonding or LAG interfaces can experience kernel crashes or memory corruption during interface registration changes, leading to downtime and potential data loss on servers and embedded devices.

How an attack unfolds

An attacker with local access or the ability to trigger network interface events (such as unplugging or reconfiguring bonded interfaces) causes the shared handler to interpret a NETDEV_UNREGISTER notifier info struct as a bonding info struct, resulting in out-of-bounds memory access.

How to fix it

Update the Linux kernel to a version containing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 which separates the NETDEV_UNREGISTER handler and removes the unbalanced dev_put.

How to confirm the fix worked

Confirm the running kernel contains commit 8bb7eca972ad531c9b149c0a51ab43a417385813 or later; reproduce NETDEV_UNREGISTER events on bonded interfaces and verify absence of KASAN stack-out-of-bounds reports.

Typical attack path

1. Obtain local access or trigger network configuration changes on a vulnerable Linux kernel
2. Cause a bonded interface to receive a NETDEV_UNREGISTER event while the incorrect handler is active
3. Trigger the mismatched struct access leading to KASAN-detected stack corruption
4. Result in kernel panic or exploitable memory corruption

How to detect it

Search kernel logs for KASAN stack-out-of-bounds errors mentioning netdev_notifier_info, NETDEV_UNREGISTER, or bonding/LAG handlers; examine dmesg and syslog for call traces around interface unregister events.

• BUG: KASAN: stack-out-of-bounds
• netdev_notifier_info
• NETDEV_UNREGISTER
• LAG NETDEV_UNREGISTER handler

What your security team should do

• Prioritize kernel upgrades on all systems using network bonding or LAG
• Monitor for KASAN reports involving netdev notifier handlers
• Test interface register/unregister sequences in staging environments before production rollout