Security readout for executives and security teams
Plain-English summary
CVE-2022-49388 is a Linux kernel memory-safety flaw in UBI volume creation error handling. A local user with some privileges could potentially trigger a use-after-free, with confidentiality, integrity, and availability impact rated high by CVSS.
Executive priority
Prioritize patching affected Linux systems where local users or services can interact with UBI. Business urgency is higher for shared, embedded, or appliance environments because successful exploitation could affect system stability and kernel-level security boundaries.
Technical view
The flaw is CWE-416 in ubi_create_volume(). On a volume creation failure path, eba_tbl could be installed into vol->eba_tbl and then freed, allowing later cleanup to reference freed memory. The kernel fix removes the redundant eba_tbl release.
Likely exposure
Exposure is most likely on systems running affected Linux kernel versions with the UBI subsystem present and reachable. This is especially relevant to embedded or flash-backed Linux environments. The CVE lists local attack vector and low privileges required.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. It mentions a reproducer link in the kernel description, but no weaponized exploitation evidence is provided here.
Researcher notes
The record provides strong root-cause detail and upstream stable commit references, but product-specific distribution mappings are incomplete in the bundle. Validate against downstream vendor kernels rather than assuming version numbers alone prove exposure or remediation.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- For appliances or embedded devices, obtain firmware with the corrected Linux kernel.
- Restrict local access to UBI management interfaces until patched.
- Track distribution advisories for exact package-level fixed versions.
Validation and detection
- Inventory kernels against the affected versions listed in the CVE record.
- Confirm the running kernel includes one of the referenced stable commits.
- Identify systems with UBI enabled, loaded, or operationally required.
- Review local access paths to UBI administration capabilities.
- Check kernel logs for UBI-related crashes during failed volume creation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49388 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25ff1e3a1351c0d936dd1ac2f9e58231ea1510c9CVE reference, Linux
- https://git.kernel.org/stable/c/abb67043060f2bf4c03d7c3debb9ae980e2b6db3CVE reference, Linux
- https://git.kernel.org/stable/c/8302620aeb940f386817321d272b12411ae7d39fCVE reference, Linux
- https://git.kernel.org/stable/c/6d8d3f68cbecfd31925796f0fb668eb21ab06734CVE reference, Linux
- https://git.kernel.org/stable/c/5ff2514e4fb55dcf3d88294686040ca73ea0c1a2CVE reference, Linux
- https://git.kernel.org/stable/c/e27ecf325e51abd06aaefba57a6322a46fa4178bCVE reference, Linux
- https://git.kernel.org/stable/c/1174ab8ba36a48025b68b5ff1085000b1e510217CVE reference, Linux
- https://git.kernel.org/stable/c/8c03a1c21d72210f81cb369cc528e3fde4b45411CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.