CVE-2022-48872

What it actually does

Race condition in fastrpc map reference counting allows a map to be looked up and used after its refcount reaches zero and it is freed, triggering a use-after-free with kernel memory corruption potential.

Why it matters to the business

May enable local attackers to crash devices or gain elevated privileges on Linux systems and Android devices, causing service outages, data exposure, or full device takeover.

How an attack unfolds

A local attacker concurrently invokes fastrpc map creation and lookup paths so that fastrpc_map_lookup obtains a reference between the zero-refcount check and lock acquisition in fastrpc_free_map, leading to use-after-free that can be turned into memory reads or writes.

How to fix it

Update to a kernel containing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or apply the Android fastrpc fix released 2021-08-05; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c; reproduce fastrpc map operations under load and verify absence of refcount saturation warnings in dmesg.

Typical attack path

1. Gain local execution on an affected kernel
2. Issue concurrent fastrpc_device_ioctl calls that create and free maps
3. Trigger the window between fastrpc_map_get and lock acquisition
4. Leverage the resulting dangling map reference for memory corruption or code execution

How to detect it

Search kernel logs for refcount_t addition-on-zero warnings mentioning fastrpc_map_get or fastrpc_map_lookup; correlate with preceding fastrpc_internal_invoke or fastrpc_device_ioctl entries before crashes.

What your security team should do

• Prioritize kernel upgrades on all Android and Linux deployments using fastrpc
• Limit untrusted code access to fastrpc ioctl interfaces until patched
• Add kernel log monitoring for refcount warnings tied to fastrpc