CVE-2022-49014

What it actually does

Use-after-free in tun_detach() where sock_put() drops the final reference to struct net before notifier_call_chain() from netdev_state_change() accesses the freed object, causing KASAN-detected reads during TUN device close.

Why it matters to the business

Risk of kernel crashes, denial of service, or local privilege escalation on Linux systems using TUN/TAP interfaces; low EPSS but referenced in 2024 zero-day campaigns by espionage and financially motivated actors, with high downstream Linux kernel prevalence.

How an attack unfolds

An attacker opens a TUN device, triggers detachment via close or process exit to race the final sock_put against notifier callbacks, and leverages the freed struct net for arbitrary read or escalation; observed in 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and related Linux kernel privilege escalation chains.

How to fix it

Upgrade affected Linux kernel packages to a version containing the fix; for honojs/hono (GIT) apply commit aa50e0ab77b5af8c53c50fe3b271892f8eeeea82. Reboot systems and verify TUN functionality post-update. Prioritize due to references in active exploitation campaigns.

How to confirm the fix worked

Confirm kernel builds contain the patch in drivers/net/tun.c around tun_detach; run syzkaller-style fuzzing or targeted close/detach tests while monitoring KASAN; check dmesg for absence of notifier_call_chain UAF reports on affected interfaces.

Typical attack path

1. Open or create a TUN/TAP device via /dev/net/tun
2. Configure the interface and hold references
3. Trigger device close or process exit to invoke tun_chr_close and __tun_detach
4. Race the final sock_put against netdev notifier chains
5. Access the freed struct net object for memory corruption or control flow hijack

How to detect it

Search kernel logs and crash reports for KASAN use-after-free in notifier_call_chain+0x1ee/0x200 combined with tun_detach or tun_chr_close; inspect task_work_run and netdev_run_todo traces; correlate with process exit of tun users; review audit logs for unusual TUN device opens/closes by untrusted processes.

• BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200
• tun_detach drivers/net/tun.c:704
• tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467
• netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351
• call_netdevice_notifiers net/core/dev.c:1997

What your security team should do

• Immediately inventory all Linux hosts using TUN/TAP and schedule kernel updates
• Monitor EPSS trend and threat actor activity for any rise in exploitation
• Deploy kernel live-patching where available and enable KASAN or similar detection in test environments
• Harden TUN usage with namespace isolation and least-privilege container configurations
• Update detection rules for the listed IOCs and review logs for historical exploitation