CVE-2022-48988

What it actually does

Use-after-free in memcg_write_event_control() caused by missing file type verification on cgroup interface files, allowing d_name and parent dentry accesses to race against arbitrary renames and removals after the __file_cft() check was dropped.

Why it matters to the business

Linux systems may experience kernel crashes, memory corruption, or local privilege escalation, leading to service outages, data exposure, or full host compromise on servers, containers, and embedded devices running affected kernels.

How an attack unfolds

An attacker opens a non-cgroup file descriptor, passes it to a cgroup event control write, and races file operations to trigger the freed dentry access; listed threat actors in 2024 zero-day campaigns could chain this with other kernel bugs for remote or local code execution on Linux.

How to fix it

Apply the upstream fix by upgrading to a kernel containing commit b77600e26fd48727a95ffd50ba1e937efb548125 (or equivalent backports); rebuild and reboot with the patched kernel; for avaiga/taipy update to commit b64b139f4ab7fe4d1f3590956040a3429aa600c5.

How to confirm the fix worked

Confirm kernel source contains the resurrected superblock and dentry type checks in memcg_write_event_control(); run regression tests exercising cgroup event control writes under concurrent file operations; verify no UAF reports in kmemleak or KASAN after patching.

Typical attack path

1. Identify unpatched Linux kernel version with vulnerable memcg code
2. Create or reference a non-regular file that can be renamed or removed
3. Issue write to cgroup.event_control using the crafted fd
4. Race rename/remove operations to dereference freed dentry structures
5. Trigger use-after-free to corrupt kernel memory or execute code

How to detect it

Search kernel logs for oops or panic messages referencing memcg_write_event_control or dentry operations; inspect audit logs for unusual writes to cgroup.event_control files; correlate with process activity creating or renaming files in /sys/fs/cgroup during event writes.

• memcg_write_event_control
• cgroup_event
• __file_cft

What your security team should do

• Prioritize kernel updates on all production Linux hosts within maintenance windows
• Enable kernel hardening features such as KASAN and lockdown mode where feasible
• Monitor for downstream package updates in distributions and container base images
• Review cgroup usage in orchestration platforms for unnecessary event control writes