CVE-2022-48817

What it actually does

Use-after-free in the ar9331 DSA switch MDIO bus handling where mdiobus_free() is invoked on a still-registered bus during device release on shutdown, triggered by device links when the DSA master resides on a bus that unbinds consumers at shutdown.

Why it matters to the business

Kernel panics or system crashes on affected Linux distributions during shutdown sequences, causing unplanned downtime and potential data loss on servers or embedded devices using the ar9331 switch; high prevalence across Ubuntu cloud and enterprise kernels increases exposure surface.

How an attack unfolds

An attacker with local or physical access triggers a controlled shutdown on systems where the DSA master uses a bus that calls remove from shutdown (such as fsl-mc), causing device_links_unbind_consumers to unbind the driver while the MDIO bus remains registered, leading to the panic in devres release; threat actor references to Android kernel RCE indicate possible interest in similar kernel memory issues though this specific flaw is not known to be remotely exploitable without additional primitives.

How to fix it

Upgrade to the fixed package versions listed for each affected Ubuntu release: linux-aws-5.15 to 5.15.0-1014.18~20.04.1, linux-azure-5.15 to 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 to 5.15.0-1019.24~20.04.1.1, linux-gcp-5.15 to 5.15.0-1006.9~20.04.1, linux-gkeop-5.15 to 5.15.0-1003.5~20.04.2, linux-hwe-5.15 to 5.15.0-33.34~20.04.1, linux-ibm-5.15 to 5.15.0-1033.36~20.04.1, linux-lowlatency-hwe-5.15 to 5.15.0-33.34~20.04.1, linux-oracle-5.15 to 5.15.0-1007.9~20.04.1, linux-riscv-5.15 to 5.15.0-1015.17~20.04.1, linux-xilinx-zynqmp to 5.4.0-1020.24, linux to 5.15.0-23.23, linux-aws to 5.15.0-1003.5, linux-aws-6.5 to 6.5.0-1008.8~22.04.1, linux-azure to 5.15.0-1002.3, linux-azure-6.5 to 6.5.0-1007.7~22.04.1, linux-azure-fde to 5.15.0-1019.24.1; reboot after upgrade.

How to confirm the fix worked

Verify installed kernel package versions match or exceed the listed fixed versions for the distribution; confirm absence of the vulnerable ar9331 driver registration path via source inspection or module load tests on shutdown; monitor kernel logs for mdiobus-related panics post-upgrade.

Typical attack path

1. Identify target systems running affected Ubuntu kernels with ar9331 DSA hardware or compatible master buses
2. Gain sufficient privileges to initiate shutdown or reboot
3. Trigger shutdown sequence that activates device link unbinding
4. Force the driver removal path that calls devm_mdiobus_free on a registered bus
5. Trigger kernel panic via mdiobus_free on still-registered MDIO bus

How to detect it

Search kernel logs and dmesg for mdiobus_free panic traces or devres release errors during shutdown; inspect boot and shutdown logs for ar9331 or DSA master unbind events on affected hardware; correlate with device link unbind messages in systems using fsl-mc or similar buses.

What your security team should do

• Prioritize patching all listed Ubuntu 20.04 and 22.04 kernel packages within the next maintenance window due to 823 days of exposure
• Inventory systems using DSA switches or fsl-mc buses to assess shutdown crash risk
• Apply updates and schedule reboots; test in staging environments first
• Monitor EPSS and threat actor activity for any increase in exploit maturity
• Disable unnecessary DSA interfaces if patching is delayed