CVE-2022-28388: Linux Kernel Use-After-Free Vulnerability

CVE-2022-28388 Overview

CVE-2022-28388 is a double free vulnerability in the Linux kernel's usb_8dev_start_xmit function located in drivers/net/can/usb/usb_8dev.c. The flaw affects Linux kernel versions through 5.17.1 and exists in the CAN (Controller Area Network) USB driver subsystem. A local attacker with low privileges can trigger the double free condition to cause kernel memory corruption, resulting in denial of service through a system crash. The vulnerability is categorized under [CWE-415] Double Free.

Critical Impact
A local attacker can exploit the double free in the usb_8dev CAN USB driver to corrupt kernel memory and trigger a denial of service condition on affected Linux systems.

Affected Products

Linux Kernel through version 5.17.1
Debian Linux 10.0 and 11.0
Fedora 34, 35, 36 and NetApp HCI H-Series firmware (H300S/H500S/H700S/H300E/H500E/H700E/H410S/H410C)

Discovery Timeline

2022-04-03 - CVE-2022-28388 published to the National Vulnerability Database
2022-05-13 - NetApp publishes security advisory NTAP-20220513-0001
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2022-28388

Vulnerability Analysis

The vulnerability resides in the usb_8dev_start_xmit function within the drivers/net/can/usb/usb_8dev.c source file. This function handles transmission of CAN frames over USB-connected 8devices USB2CAN adapters. The function contains a code path where an allocated resource is released twice during error handling, leading to a double free condition [CWE-415].

When the kernel frees the same memory region twice, the allocator's internal data structures become corrupted. This corruption can crash the kernel or, in some scenarios, be leveraged to manipulate the heap layout. The flaw was addressed by upstream commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 in the Linux kernel source tree.

Root Cause

The root cause is improper error handling in the transmit path of the usb_8dev CAN driver. When transmission setup fails, cleanup logic releases a buffer or USB request block that has already been freed elsewhere in the function. The missing pointer nullification or reordering of cleanup operations allowed the same allocation to be returned to the kernel allocator twice.

Attack Vector

Exploitation requires local access and low privileges on a system where the affected usb_8dev driver is loaded. The attack vector is local with low attack complexity. An attacker interacts with the CAN USB interface through socket operations or device manipulation to trigger the vulnerable code path. Successful exploitation produces a high availability impact, typically a kernel panic or system hang. The vulnerability does not directly expose confidential data or allow integrity modification.

No public proof-of-concept exploit is available, and the EPSS score reflects a very low predicted exploitation likelihood. Refer to the upstream Linux kernel commit for the precise code-level fix.

Detection Methods for CVE-2022-28388

Indicators of Compromise

Unexpected kernel panics or oops messages referencing usb_8dev_start_xmit or the CAN subsystem in dmesg and /var/log/kern.log
Slab allocator corruption warnings such as kernel BUG at mm/slub.c accompanied by double free diagnostics
Unexplained system reboots on hosts with CAN USB adapters attached

Detection Strategies

Inventory Linux hosts to identify systems where the can_dev and usb_8dev kernel modules are loaded using lsmod | grep usb_8dev
Compare running kernel versions against patched releases listed in the Debian DSA-5127 and Debian DSA-5173 advisories
Audit hosts with USB CAN hardware connected, as these are the realistic exposure surface for this driver

Monitoring Recommendations

Monitor kernel ring buffer output for double free signatures and CAN driver stack traces using log aggregation
Track loading of the usb_8dev module via auditd rules on init_module and finit_module syscalls
Alert on repeated unexpected reboots or kernel crashes correlated with USB device events

How to Mitigate CVE-2022-28388

Immediate Actions Required

Update the Linux kernel to a version that includes commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 on all affected hosts
Apply distribution updates from Debian, Fedora, and NetApp as published in their respective security advisories
Restrict physical access to systems with USB ports where untrusted CAN devices could be attached

Patch Information

The upstream fix is available in the Linux kernel commit 3d3925ff6433. Distribution patches are published in Debian DSA-5127, Debian DSA-5173, Fedora package announcements for releases 34, 35, and 36, and NetApp Security Advisory NTAP-20220513-0001.

Workarounds

Blacklist the usb_8dev kernel module on systems that do not require 8devices USB2CAN hardware
Use udev rules to prevent automatic binding of unknown CAN USB devices on production hosts
Limit non-administrative user access to systems exposing CAN networking interfaces

bash

# Blacklist the usb_8dev module to prevent it from loading
echo "blacklist usb_8dev" | sudo tee /etc/modprobe.d/blacklist-usb_8dev.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep usb_8dev