CVE-2022-49029

What it actually does

Use-after-free in the ibmpex hwmon driver when ibmpex_register_bmc fails after adding data to driver_data.bmc_data; the list entry is not removed before kfree, allowing later list traversals to dereference freed memory.

Why it matters to the business

Linux systems using ibmpex hardware monitoring may experience kernel crashes, denial of service, or potential privilege escalation; high ecosystem prevalence increases exposure for servers and embedded devices, with remediation urgency driven by known exploitation campaigns despite low EPSS.

How an attack unfolds

An attacker triggers ibmpex_register_bmc failure (for example via resource exhaustion or sensor detection error), leaving a dangling list entry; subsequent list walks in the driver then access the freed structure, enabling use-after-free primitives that have been observed in 2024 zero-day campaigns by espionage and financially motivated actors.

How to fix it

Upgrade to a kernel containing commit f6818efbc23bf7206229fb739b2d2f6d34852267 or later that removes the list entry before freeing; apply vendor backports for affected distributions; disable ibmpex module if hardware monitoring is not required.

How to confirm the fix worked

Confirm the fix by inspecting drivers/hwmon/ibmpex.c around ibmpex_register_bmc for list_del before kfree of the data structure; run Smatch or similar static analysis on the patched tree and verify no warning for '&data->list' remains.

Typical attack path

1. Identify systems exposing ibmpex hwmon interfaces or BMC registration paths
2. Force ibmpex_register_bmc to fail after list insertion but before cleanup
3. Trigger list traversal that dereferences the freed data object
4. Leverage resulting memory corruption for code execution or denial of service

How to detect it

Search kernel logs and audit trails for ibmpex_register_bmc failures followed by list-related warnings or oops involving driver_data.bmc_data; inspect dmesg and /var/log/kern.log for UAF signatures or page faults referencing ibmpex; correlate with threat actor TTPs around Linux kernel memory corruption.

• ibmpex_register_bmc.*warn.*list not removed
• drivers/hwmon/ibmpex.c:509
• BUG: KASAN: use-after-free in ibmpex
• list_del corruption detected in hwmon

What your security team should do

• Prioritize patching all Linux kernels using ibmpex within the next 30 days given observed exploitation campaigns
• Audit systems for ibmpex module usage and remove unnecessary BMC monitoring drivers
• Enable kernel hardening features such as CONFIG_SLAB_FREELIST_HARDENED and KASAN for detection
• Monitor EPSS trend and threat actor reports for any increase in targeting