CVE-2022-48815

What it actually does

Use-after-free condition in the bcm_sf2 DSA switch driver when devm_mdiobus_alloc registers an MDIO bus that is later freed via devres during device unbind on shutdown, because the bus was never unregistered before the managed release path executes.

Why it matters to the business

Unexpected kernel panics or crashes on systems using Broadcom Starfighter 2 switches when the DSA master device shuts down, leading to loss of network connectivity and potential service disruption on affected Linux distributions.

How an attack unfolds

An attacker with the ability to trigger orderly shutdown or driver unbind of the DSA master (for example via power management or fsl-mc bus events) causes device_links_unbind_consumers to remove the bcm_sf2 driver while the MDIO bus remains registered; subsequent devres release then calls mdiobus_free on a still-registered bus, triggering the panic or use-after-free.

How to fix it

Upgrade to fixed kernel versions listed for each distribution: Debian 12/13 use 5.16.10-1 or newer; Ubuntu 20.04 LTS and derivative packages (linux-aws, linux-azure, linux-gcp, etc.) use the corresponding 5.4.0-*, 5.15.0-* or 5.16+ builds that replace devm_mdiobus_alloc with manual allocation and explicit unregister/free paths.

How to confirm the fix worked

Confirm the running kernel contains the commit that removes devm_mdiobus_alloc and adds explicit mdiobus_free after unregister; verify with modinfo or source inspection that bcm_sf2 no longer uses managed MDIO allocation, then test driver load/unload and shutdown sequences on bcm_sf2 hardware.

Typical attack path

1. Gain local access or control over shutdown events on a system with bcm_sf2 DSA hardware
2. Trigger device removal or system shutdown that propagates to the DSA master
3. Force unbind of the bcm_sf2 driver via device link while MDIO bus is still registered
4. Allow devres release to invoke mdiobus_free on the unregistered bus, causing panic or memory corruption

How to detect it

Search kernel logs and dmesg for panic strings or oops involving mdiobus_free, devm_mdiobus_free, or bcm_sf2 during shutdown; inspect auditd or systemd logs for unexpected driver unbind events on DSA masters; review crash dumps for device release paths on fsl-mc or similar buses.

• mdiobus_free
• devm_mdiobus_free
• bcm_sf2
• device_links_unbind_consumers

What your security team should do

• Prioritize patching all listed Ubuntu 20.04 and Debian 12/13 packages to the stated fixed versions before the next maintenance window
• Monitor for kernel oops or panic logs referencing mdiobus_free or bcm_sf2 during shutdown events
• Where immediate patching is impossible, restrict physical or privileged access to systems containing Starfighter 2 switches