CVE-2022-0487 Overview
CVE-2022-0487 is a use-after-free vulnerability in the Linux kernel memstick subsystem. The flaw resides in the rtsx_usb_ms_drv_remove function within drivers/memstick/host/rtsx_usb_ms.c. A local attacker with user-level privileges can leverage the issue to impact system confidentiality by accessing kernel memory that has already been freed. The vulnerability affects Linux kernel versions prior to 5.14-rc1 and impacts multiple downstream distributions including Red Hat Enterprise Linux and Debian. The weakness is classified under CWE-416: Use After Free.
Critical Impact
A local, authenticated attacker can trigger use-after-free conditions in the kernel memstick USB driver, potentially leaking sensitive kernel memory contents and undermining the confidentiality of the host system.
Affected Products
- Linux Kernel versions prior to 5.14-rc1
- Red Hat Enterprise Linux 8
- Debian Linux 9 and 11
Discovery Timeline
- 2022-02-04 - CVE-2022-0487 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-0487
Vulnerability Analysis
The vulnerability exists in the Realtek USB memstick host driver shipped with the Linux kernel. The rtsx_usb_ms_drv_remove routine handles device removal cleanup for memory stick host controllers exposed over USB. During the teardown path, the driver releases a structure but retains references that other in-flight operations can dereference. This results in a classic use-after-free condition as described in CWE-416. An attacker holding only standard user privileges on a system with the affected driver loaded can interact with the device removal logic to trigger the flaw. Successful exploitation allows reading of freed kernel slab memory, exposing potentially sensitive data such as cryptographic material, kernel pointers, or other process state.
Root Cause
The root cause is improper lifetime management between the driver's removal callback and concurrently scheduled work or references inside the memstick host structure. The cleanup sequence in rtsx_usb_ms_drv_remove frees memory while another execution path still holds a usable pointer to that memory. The upstream fix, committed as 42933c8aa14be1caa9eda41f65cde8a3a95d3e39, reorders teardown operations to ensure outstanding work is fully completed and references are dropped before the underlying allocation is released.
Attack Vector
Exploitation requires local access and a low-privilege user account on a host where the rtsx_usb_ms driver is loaded. The attacker must coerce the driver removal path to race with active memstick operations. Because the attack vector is local and requires user-level privileges, network-based exploitation is not possible. The impact is limited to confidentiality. Integrity and availability are not affected per the published CVSS metrics. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is available for this vulnerability. Technical details can be reviewed in the upstream kernel commit and the Red Hat Bug Report.
Detection Methods for CVE-2022-0487
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing rtsx_usb_ms or memstick subsystem functions in dmesg or /var/log/kern.log.
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free conditions in drivers/memstick/host/rtsx_usb_ms.c on instrumented kernels.
- Anomalous USB device attach and detach cycles initiated by non-root users on systems exposing Realtek card reader hardware.
Detection Strategies
- Audit installed kernel package versions against vendor advisories such as Debian DSA-5095 and DSA-5096 to identify unpatched hosts.
- Monitor kernel ring buffer logs for slab corruption signatures, general protection faults, or KASAN findings tied to memstick driver symbols.
- Track loaded kernel modules with lsmod and flag systems where rtsx_usb_ms is present on workloads that do not require memory stick support.
Monitoring Recommendations
- Centralize kernel logs and search for crash signatures referencing memstick or rtsx_usb driver symbols.
- Alert on repeated USB enumeration events from unprivileged user sessions, which can indicate attempts to race the driver removal path.
- Review process accounting data for user-space processes that bind to or manipulate /dev/mmcblk* and related memstick device nodes.
How to Mitigate CVE-2022-0487
Immediate Actions Required
- Apply vendor kernel updates from Red Hat, Debian, and other downstream distributions that include the upstream fix commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39.
- Upgrade to Linux kernel 5.14-rc1 or later on systems running mainline kernels.
- Inventory hosts that load the rtsx_usb_ms module and prioritize patching for endpoints with untrusted local users.
Patch Information
The upstream fix is available in the Linux Kernel commit 42933c8a and is included in kernel 5.14-rc1 and newer. Distribution-specific updates are published in Debian DSA-5095, Debian DSA-5096, Debian LTS Announcement #11, and Debian LTS Announcement #12. Red Hat customers should consult Bugzilla 2044561 for RHEL-specific guidance.
Workarounds
- Blacklist the rtsx_usb_ms kernel module on systems that do not require Realtek USB memstick functionality.
- Restrict physical and logical USB access using udev rules or USBGuard to prevent untrusted devices from binding to the driver.
- Limit interactive local accounts on systems where patching cannot be performed immediately.
# Blacklist the vulnerable driver until patches are applied
echo "blacklist rtsx_usb_ms" | sudo tee /etc/modprobe.d/blacklist-rtsx-usb-ms.conf
sudo rmmod rtsx_usb_ms 2>/dev/null
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
