CVE-2022-48874

What it actually does

Race condition between mutex unlock in map lookup and subsequent reference count increment allows concurrent access to a freed fastrpc map object, resulting in use-after-free.

Why it matters to the business

Local attackers can trigger kernel memory corruption on affected Android and Linux devices, potentially leading to system instability, crashes, or elevated privileges with no widespread in-the-wild exploitation observed.

How an attack unfolds

An attacker with local code execution on a device using the fastrpc driver triggers concurrent calls to map lookup and find functions; the race window permits one thread to free the map while another still holds a dangling reference, enabling use-after-free memory manipulation.

How to fix it

Update to Linux kernel commit a50c5c25b6e7d2824698c0e6385f882a18f4a498 or later; Qualcomm SoC devices require firmware dated 2021-10-05 or newer that incorporates the merged lookup/get logic protected by the spinlock.

How to confirm the fix worked

Confirm kernel sources contain the merged fastrpc_map_lookup implementation that acquires the spinlock before reference count operations and verify the commit hash or SoC version string matches the fixed release.

Typical attack path

1. Obtain local execution on target device
2. Load or trigger fastrpc driver usage via DSP offload APIs
3. Race map lookup and get operations to hit the window between mutex release and refcount acquisition
4. Manipulate freed object for memory corruption or information leak

How to detect it

Review kernel logs for fastrpc-related oops or use-after-free warnings; inspect for unexpected map reference count underflows or crashes in the fastrpc driver path around DSP map operations.

What your security team should do

• Prioritize patching Android devices and embedded Linux systems that expose fastrpc interfaces
• Audit custom kernels for backported equivalent of the spinlock-protected lookup path
• Monitor vendor security bulletins for Qualcomm chipset updates