CVE-2022-48861

What it actually does

A use-after-free vulnerability occurs when the vp_vdpa structure is freed during driver unbind in vdpa_unregister_device but subsequently accessed in vp_modern_remove, leading to dereference of freed memory.

Why it matters to the business

This flaw can cause kernel crashes or system instability on Linux systems using the vp_vdpa driver, potentially leading to denial of service and requiring urgent patching across affected deployments.

How an attack unfolds

An attacker with local privileges unbinds the vp_vdpa driver, triggering the free in vdpa_unregister_device followed by a dereference in vp_modern_remove.

How to fix it

Update the Linux kernel to the fixed commit 4b1743bc715a3691a63ac21b349079b07bf1b19e or later versions.

How to confirm the fix worked

Verify the kernel source includes the fix commit or test by attempting driver unbind on updated systems.

Typical attack path

1. Obtain local access to the system
2. Identify and unbind the vp_vdpa driver
3. Trigger the use-after-free through device removal operations

How to detect it

Look for kernel logs showing use-after-free errors or call traces involving vp_vdpa_remove and vp_modern_remove.

What your security team should do

• Apply the kernel patch immediately
• Monitor for kernel oops related to vp_vdpa
• Restrict local access where possible