CVE-2022-3628 in Linux
Summary
by MITRE • 01/12/2023
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/18/2026
The vulnerability identified as CVE-2022-3628 represents a critical buffer overflow flaw within the Linux kernel's Broadcom Full MAC Wi-Fi driver implementation. This flaw exists in the handling of data structures during USB device connection processes, specifically when the system interacts with maliciously crafted USB peripherals. The vulnerability is categorized under CWE-121 as a stack-based buffer overflow, which occurs when insufficient bounds checking is performed on user-supplied data during driver initialization or device communication phases. The issue manifests when the kernel driver processes input from USB-connected devices without adequate validation of buffer boundaries, creating an exploitable condition that can be leveraged by local attackers with physical access to the target system.
The technical exploitation of this vulnerability requires a local attacker to have physical access to the target machine and the ability to connect a malicious USB device that triggers the vulnerable code path within the Broadcom Full MAC driver. When the kernel attempts to process data structures from the USB device, the insufficient buffer size validation allows an attacker to overwrite adjacent memory locations. This memory corruption can lead to two primary attack vectors: system crashes through denial of service conditions or privilege escalation by overwriting kernel memory structures. The attack surface is particularly concerning because it requires minimal user interaction beyond physical device connection, making it difficult to detect and prevent through traditional network-based security measures.
The operational impact of this vulnerability extends beyond simple system instability, as it provides a pathway for privilege escalation attacks that can compromise the entire system. When exploited successfully, the buffer overflow can allow a local user to execute arbitrary code with kernel-level privileges, effectively bypassing all standard user-space security controls. This represents a significant threat to system integrity and confidentiality, as attackers can gain complete control over the affected system. The vulnerability affects systems running Linux kernels with the Broadcom Full MAC Wi-Fi driver implementation, particularly those that support USB device connections and wireless networking functionality. The attack vector is particularly dangerous because it can be triggered through legitimate USB device connections, making it difficult to distinguish between benign and malicious devices without proper kernel-level monitoring.
Mitigation strategies for CVE-2022-3628 should focus on both immediate patching and operational security measures. The primary solution involves applying the relevant kernel security patches released by the Linux kernel team, which include enhanced buffer validation and bounds checking mechanisms within the Broadcom Full MAC driver code. Organizations should implement a comprehensive patch management process to ensure all affected systems receive updates promptly. Additionally, operational security controls should include disabling unnecessary USB device support where possible, implementing USB device whitelisting policies, and monitoring for unusual USB device connections. The vulnerability aligns with ATT&CK technique T1059.001 for privilege escalation through kernel exploits and T1566 for initial access via USB devices. System administrators should also consider implementing kernel module signing requirements and monitoring for anomalous kernel memory access patterns that could indicate exploitation attempts.