CVE-2022-48962

What it actually does

Use-after-free in hisi_femac_rx() after napi_gro_receive() frees the skb, allowing subsequent dereference of the freed buffer.

Why it matters to the business

Potential system instability or code execution on affected Linux systems could disrupt network operations and require urgent patching; the issue has no active ransomware usage or CISA deadline but appears in broad zero-day campaigns.

How an attack unfolds

An attacker sends crafted network traffic to trigger the hisi_femac receive path; napi_gro_receive frees the skb and the code then accesses the dangling pointer, enabling memory corruption that can be leveraged for privilege escalation in campaigns by espionage and financially motivated actors.

How to fix it

Update to the fixed commit 6e37f0cd8ba5fc527412f18f66cd6a37015fa690 in the inventree/inventree repository or apply the equivalent upstream Linux kernel patch that resolves the use-after-free.

How to confirm the fix worked

Verify the running kernel or inventree component contains commit 6e37f0cd8ba5fc527412f18f66cd6a37015fa690 and confirm the hisi_femac_rx function no longer dereferences the skb after napi_gro_receive.

Typical attack path

1. Send malicious packets to the Hisilicon FEMAC interface
2. Trigger napi_gro_receive to release the skb
3. Dereference the freed skb pointer to corrupt memory
4. Escalate to kernel code execution or denial of service

How to detect it

Inspect kernel logs and network driver traces for use-after-free warnings or crashes in hisi_femac_rx; correlate with threat actor activity involving Linux kernel memory issues.

What your security team should do

• Apply the referenced commit immediately on all affected systems
• Prioritize patching given presence in 2024 zero-day campaigns
• Monitor for new EPSS increases or KEV listings
• Review network-facing Hisilicon FEMAC drivers for similar patterns