CVE-2022-48924

What it actually does

The vulnerability is a memory leak in the int3400_notify() function within the Linux kernel's int3400_thermal driver, where kasprintf-allocated strings for ACPI notification events are not freed, leading to gradual memory exhaustion.

Why it matters to the business

Systems running affected Linux kernels may experience increasing memory usage over time, potentially resulting in performance degradation or system instability on platforms with frequent thermal notifications.

How an attack unfolds

An attacker with the ability to trigger repeated ACPI thermal notifications (such as through hardware events or local processes) can cause the kernel to allocate memory without freeing it in int3400_notify(), leading to resource exhaustion.

How to fix it

Update the Linux kernel to a version containing commit f0ddc5184b0127038d05008e2a69f89d1e13f980 or apply the equivalent patch that adds kfree() calls in int3400_notify().

How to confirm the fix worked

Monitor kernel memory usage for leaks in int3400_thermal module; verify patch application by checking for the kfree addition in the source; run kmemleak or slabinfo before and after to confirm no more unreferenced NAME=INT3400 Thermal objects.

Typical attack path

1. Trigger ACPI notify events on int3400 thermal zone
2. Observe unreferenced kernel objects accumulating via slabinfo or kmemleak
3. Continue until memory pressure causes denial of service

How to detect it

Inspect dmesg, kmemleak reports, or slabinfo for unreferenced objects allocated from int3400_notify via kasprintf; search for strings like NAME=INT3400 Thermal in kernel memory dumps or logs from kworker processes.

• NAME=INT3400 Thermal
• int3400_notify+0x82
• unreferenced object.*kworker.*int3400_thermal
• kasprintf.*int3400_notify

What your security team should do

• Apply the kernel patch or upgrade to fixed version immediately on affected systems
• Monitor systems for unusual memory growth in kworker processes related to int3400_thermal
• Limit exposure on affected hardware like TigerLake until patched