CVE-2022-49501
Published: 26 February 2025
Summary
CVE-2022-49501 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-49501 is a use-after-free vulnerability in the Linux kernel's usbnet driver, affecting USB Ethernet adapters. A prior commit (2c9d6c2b871d) attempted to address a use-after-free during disconnect but introduced asymmetry between the usbnet_probe() and usbnet_disconnect() functions. Previously symmetric, probe invoked the bind callback before register_netdev(), while disconnect mirrored this with unregister_netdev() before unbind. The flawed commit reversed the disconnect order, causing issues such as a PHY being stopped twice—once in unbind and again in unregister_netdev—necessitating workarounds in the stop function and complicating PHY handling (CWE-416).
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation likely occurs during USB Ethernet adapter disconnect, triggering the use-after-free or related mishandling in unbinding, potentially leading to kernel crashes, arbitrary code execution, or denial of service.
Mitigation involves applying stable kernel patches that revert the problematic commit and restore symmetric binding/unbinding, as detailed in kernel stable repository commits such as 6d5deb242874d924beccf7eb3cef04c1c3b0da79, 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509, d1408f6b4dd78fb1b9e26bcf64477984e5f85409, and fbda837107f9bd4ec658d2aa88c6856dba606f06. These changes allow unconditional phy_stop() calls in the stop function, resolving the double-stop issue without needing prior contortions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54728
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different…
more
fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in usbnet driver directly enables privilege escalation via arbitrary code execution from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates the timely remediation of identified flaws, directly addressing the use-after-free vulnerability in the Linux kernel's usbnet driver by applying the necessary patches to restore symmetric probe and disconnect operations.
RA-5 requires vulnerability scanning and monitoring to identify systems running kernel versions affected by CVE-2022-49501, enabling proactive patching.
SI-16 implements memory protection mechanisms such as kernel address space layout randomization and supervisor mode execution prevention, mitigating exploitation of the use-after-free during USB Ethernet adapter disconnect.