CVE-2022-50843

What it actually does

Use-after-free in dm-clone target's clone_dtr() when dm_resume() and dm_destroy() execute concurrently, allowing access to a freed timer structure after initial cancellation.

Why it matters to the business

Kernel crashes or potential privilege escalation on Linux systems using dm-clone targets, increasing downtime risk and exposure to compromise in storage virtualization environments.

How an attack unfolds

An attacker triggers a race between device resume and destroy operations on a dm-clone target, causing clone_dtr() to reference a timer that has already been freed, enabling memory corruption for code execution or denial of service.

How to fix it

Apply the upstream fix in commit 520b56cfd9faee7683f081c3a38f11a81b13a68e or equivalent package updates such as libvncserver 0.9.11+dfsg-1.2, veyon 4.1.4+repack1-1, or ssvnc 1.0.29-5 on Debian releases; rebuild and reboot affected kernels.

How to confirm the fix worked

Verify the presence of the timer cancellation call in clone_dtr() after patching, confirm via kernel source inspection or version checks against the listed fixed commits and package versions, and test concurrent resume/destroy workloads.

Typical attack path

1. Locate or create a dm-clone device target
2. Issue concurrent dm_resume and dm_destroy operations
3. Exploit the window where the timer is freed but still referenced
4. Corrupt kernel memory to escalate privileges or crash the system

How to detect it

Review kernel logs for dm-clone related oops or UAF warnings, inspect for concurrent dm device operations around crash times, and correlate with timer or device-mapper activity in system traces.

What your security team should do

• Prioritize kernel and affected package updates within standard change windows
• Audit systems for dm-clone usage and schedule reboots
• Monitor EPSS and any future exploit maturity increases given the 305-day publication window