CVE-2022-48952

What it actually does

Missing sentinel at the end of the struct soc_device_attribute array for mt7621_pcie_quirks_match allows soc_device_match to read past the intended entries, causing an invalid pointer dereference and kernel oops.

Why it matters to the business

Unexpected system crashes on affected MIPS-based routers or devices can interrupt network services and require manual recovery; low EPSS and absence from KEV indicate limited active exploitation risk but still necessitate patching for operational stability.

How an attack unfolds

An attacker with local or remote access that can cause the kernel to evaluate PCI quirks on an mt7621 platform triggers soc_device_match; the absent sentinel results in out-of-bounds access and immediate kernel fault.

How to fix it

Apply the upstream fix that adds the required sentinel to the quirks table; for systems using the referenced librenms package update to commit f259edc19b9f0ccca484c60b1ba70a0bfff97ef5 or later equivalent kernel patch.

How to confirm the fix worked

Confirm the quirks array definition now terminates with a zeroed sentinel entry; verify no oops occurs during boot or PCI initialization on mt7621 hardware; test with CONFIG_SOC_MT7621 enabled.

Typical attack path

1. Gain code execution or trigger PCI device enumeration on a vulnerable mt7621 system
2. Invoke path that calls soc_device_match(mt7621_pcie_quirks_match)
3. Kernel reads past array end due to missing sentinel
4. Invalid memory access produces oops and system instability

How to detect it

Search kernel logs and crash dumps for references to soc_device_match or mt7621_pcie_quirks_match around the time of unexpected reboots or oops messages; correlate with systems running mt7621 SoC and kernels before the sentinel fix.

• soc_device_match(mt7621_pcie_quirks_match)
• mt7621_pcie_quirks
• Oops in PCI quirks table walk
• CONFIG_SOC_MT7621

What your security team should do

• Prioritize patching affected kernel builds within standard maintenance windows given low EPSS
• Monitor kernel logs for mt7621 or soc_device_match related oops entries
• Ensure downstream device images include the sentinel addition before deployment