CVE-2022-48821

What it actually does

Use-after-free in the fastrpc ioctl handler when a usercopy back to userspace fails after dma_buf_fd has already installed a file descriptor, leaving a stale reference that can be dereferenced after the underlying file object is released.

Why it matters to the business

Kernel memory corruption on affected Linux systems can lead to system instability, crashes, or potential code execution by local attackers, affecting device reliability in embedded, mobile, and server environments.

How an attack unfolds

An attacker with local access invokes the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl, forces a usercopy failure after the file descriptor has been installed, then triggers use of the freed file object to corrupt kernel structures or achieve code execution, as seen in Android kernel exploitation attempts by threat actors.

How to fix it

Upgrade to fixed kernel versions: Debian 11/12/13 to 5.10.103-1 or 5.16.7-1, Ubuntu 20.04/22.04 packages to the listed 5.15.0-* or 5.4.0-* revisions, or apply the upstream patch that removes the erroneous dma_buf_put call.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed versions for each distribution, inspect the fastrpc driver source for absence of the double-put path, and confirm no crash or corruption occurs under the failing-usercopy test case.

Typical attack path

1. Obtain local code execution on the target system
2. Call FASTRPC_IOCTL_ALLOC_DMA_BUFF with parameters that cause the subsequent copy_to_user to fail
3. Trigger dereference of the now-freed file object via the installed file descriptor
4. Leverage the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Search kernel logs and audit trails for fastrpc ioctl failures followed by use-after-free warnings or oops reports; correlate with process exit handling of file descriptors on systems running vulnerable kernels.

What your security team should do

• Prioritize kernel upgrades on all affected Debian and Ubuntu systems within standard patch windows
• Monitor for local privilege-escalation attempts on devices exposing fastrpc
• Review Android kernel updates if devices share the same fastrpc code path