CVE-2022-49402 is a vulnerability in the Linux kernel's ftrace subsystem, specifically related to the handling of direct function tracing registrations. The issue arises when the function register_ftrace_direct fails during the registration of a direct function for tracing. In such failure cases, the kernel does not properly clean up the entry in the direct_functions hash table, leading to a stale or invalid entry remaining. This improper cleanup can cause a general protection fault (GPF), typically triggered by an invalid or non-canonical memory address access, resulting in a kernel crash. The vulnerability is reproducible by loading a livepatch that modifies a kernel function and then running a bpftrace command to attach a kfunc probe to the patched function. The first attempt to attach the probe fails as expected, but subsequent attempts cause the kernel to crash due to the leftover direct_functions entry. The root cause is that the entry is added to direct_functions before the failure is detected but is not removed afterward, leading to inconsistent kernel state and memory access violations. The fix involves ensuring that any failed registration attempts properly remove the corresponding entries from direct_functions, preventing stale references and subsequent faults. This vulnerability affects specific Linux kernel versions identified by the commit hash 763e34e74bb7d5c316015e2e39fcc8520bfd071c. Although no known exploits are reported in the wild, the vulnerability can lead to denial of service (DoS) through kernel crashes triggered by local users or processes capable of loading livepatches and executing bpftrace commands. The vulnerability does not require remote access or user interaction beyond local execution privileges, making it a concern primarily for systems that allow untrusted local code execution or livepatch loading. The vulnerability impacts kernel stability and availability but does not directly expose confidentiality or integrity breaches.

For European organizations, the primary impact of CVE-2022-49402 is the potential for denial of service due to kernel crashes. Systems running affected Linux kernel versions that support livepatching and bpftrace are at risk of unexpected reboots or service interruptions if exploited. This can disrupt critical infrastructure, cloud services, and enterprise environments relying on Linux servers for operations. Organizations using livepatching for kernel updates or employing bpftrace for performance monitoring and debugging are particularly vulnerable. The disruption could affect data centers, cloud providers, telecommunications, financial institutions, and public sector services across Europe. While the vulnerability does not directly allow privilege escalation or data leakage, the resulting instability can lead to operational downtime, impacting business continuity and service availability. In environments with strict uptime requirements or real-time processing, such as healthcare, manufacturing, or transportation sectors, the consequences could be severe. Additionally, the need to patch or update kernels to remediate the vulnerability may require planned maintenance windows, potentially affecting service delivery. Since no known exploits are in the wild, the immediate risk is moderate, but the vulnerability should be addressed promptly to prevent potential future exploitation.

1. Apply the official Linux kernel patch that fixes CVE-2022-49402 as soon as it becomes available from trusted sources or Linux distribution vendors. 2. Avoid running untrusted livepatches or bpftrace scripts, especially in production environments, to reduce the risk of triggering the vulnerability. 3. Restrict permissions for loading livepatches and executing bpftrace commands to trusted administrators only, minimizing the attack surface. 4. Monitor kernel logs for signs of general protection faults or crashes related to ftrace or bpftrace activities to detect potential exploitation attempts. 5. Implement kernel crash recovery and alerting mechanisms to quickly respond to any unexpected reboots or faults. 6. For environments requiring livepatching, validate patches thoroughly in test environments before deployment to production. 7. Consider disabling livepatching or bpftrace features temporarily if immediate patching is not feasible and the risk is unacceptable. 8. Maintain up-to-date backups and disaster recovery plans to mitigate the impact of potential downtime caused by kernel crashes.