CVE-2022-48873

What it actually does

Use-after-free in the fastrpc misc driver caused by removing maps from internal lists in fastrpc_init_create_process error paths and fastrpc_device_release instead of decrementing references via fastrpc_map_put; the map object can be freed while still referenced, with fastrpc_free_map being the only correct removal point after refcount reaches zero.

Why it matters to the business

Kernel memory corruption on Linux-based systems and Android devices can lead to crashes, denial of service, or potential local privilege escalation; the issue affects a wide range of embedded and mobile platforms but carries low exploitation likelihood based on current threat data.

How an attack unfolds

An attacker with local access triggers error conditions during process creation or device release in the fastrpc subsystem to force premature map removal, leaving dangling references that are later dereferenced after the object is freed, resulting in use-after-free.

How to fix it

Update the Linux kernel to a version containing commit 4b5c44e924a571d0ad07054de549624fbc04e4d7 or later; for Android, apply the 2021-07-01 security patches to frameworks/base in versions 8.1 and 11. Rebuild and deploy updated kernels or firmware images across affected devices.

How to confirm the fix worked

Verify kernel source contains the referenced commit or check that fastrpc_init_create_process and fastrpc_device_release call fastrpc_map_put rather than direct list removal; confirm Android security patch level includes the July 2021 updates for the affected branches.

Typical attack path

1. Obtain local code execution on an affected Linux or Android device
2. Interact with the fastrpc device interface to invoke fastrpc_init_create_process
3. Force an error path or device release to trigger incorrect map removal
4. Trigger subsequent operations that dereference the now-freed map object
5. Achieve memory corruption for crash or escalation

How to detect it

Examine kernel logs for fastrpc-related crashes or warnings around map handling; review process creation and device release code paths for unexpected reference count behavior; no public exploitation artifacts are known given the CVE's age and lack of KEV listing.

What your security team should do

• Prioritize kernel and Android framework updates on internet-facing or multi-user devices
• Review fastrpc usage in custom drivers or embedded products for similar reference-counting patterns
• Monitor upstream stable kernel releases for backports of the fix
• Apply updates within standard patch cycles given absence from KEV and low EPSS