CVE-2022-49390: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49390 affects the Linux kernel's MACsec (Media Access Control Security) implementation. The vulnerability was discovered when creating a new macsec device without obtaining a proper reference to real_dev, which could lead to a use-after-free (UAF) condition. The issue was reported by syzkaller and fixed in 2022 (Kernel Git).

The vulnerability occurs in the Linux kernel's MACsec driver when a new macsec device is created without properly maintaining a reference to the underlying network device (real_dev). This can result in a situation where real_dev is freed while macsec is still using it. The issue manifests as a use-after-free bug in the macsec_get_iflink function at drivers/net/macsec.c:3662. The bug was triggered after commits related to netdev unregistration and IPv6 device handling (NVD).

The vulnerability could lead to a use-after-free condition in the kernel's networking stack, potentially resulting in system crashes, memory corruption, or possible privilege escalation. The CVSS v3.1 base score is 7.8 (HIGH), with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating significant local impact (NVD).

The vulnerability requires local access and can be triggered through network device manipulation. A proof-of-concept exists as demonstrated by the syzkaller bug report, showing the exact call trace and conditions needed to trigger the use-after-free condition (Kernel Git).

The issue has been fixed by adding proper reference counting using dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev(). The fix ensures that the reference to real_dev is properly maintained throughout the device's lifecycle. Users should update to a patched version of the Linux kernel that includes the fix (Kernel Git).