CVE-2022-0742
📋 TL;DR
A memory leak vulnerability in the Linux kernel's ICMPv6 implementation allows remote attackers to cause denial-of-service by sending crafted ICMPv6 packets (types 130 or 131), leading to system memory exhaustion. This affects Linux kernel versions 5.13 and later. Any system running affected kernel versions with IPv6 enabled is vulnerable.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Complete system crash due to memory exhaustion, requiring physical reboot and potentially causing data loss or service disruption.
Likely Case
System becomes unresponsive or crashes under sustained attack, requiring reboot to restore functionality.
If Mitigated
With proper network controls, impact is limited to potential performance degradation if packets bypass filters.
🎯 Exploit Status
Exploitation is straightforward - sending crafted ICMPv6 packets to trigger the memory leak. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commit 2d3916f3189172d5c69d33065c3c21119fe539fc or later
Vendor Advisory: https://security.netapp.com/advisory/ntap-20220425-0001/
Restart Required: Yes
Instructions:
1. Update kernel to version containing the fix commit 2d3916f3189172d5c69d33065c3c21119fe539fc. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Block ICMPv6 types 130 and 131
linuxUse firewall rules to block the specific ICMPv6 packet types that trigger the vulnerability
iptables -A INPUT -p ipv6-icmp --icmpv6-type 130 -j DROP
iptables -A INPUT -p ipv6-icmp --icmpv6-type 131 -j DROP
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 130 -j DROP
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 131 -j DROP
Disable IPv6
linuxTemporarily disable IPv6 if not required for system functionality
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
🧯 If You Can't Patch
- Implement strict firewall rules to block ICMPv6 types 130 and 131 at network perimeter
- Monitor system memory usage and implement alerting for abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is 5.13 or higher and doesn't contain the fix commit, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Check if kernel contains the fix: grep -q '2d3916f3189172d5c69d33065c3c21119fe539fc' /proc/version || echo 'Check kernel source/git log'📡 Detection & Monitoring
Log Indicators:
- Kernel OOM (Out of Memory) messages in /var/log/kern.log or dmesg
- Abnormal memory consumption in system logs
- ICMPv6 packet drops in firewall logs
Network Indicators:
- High volume of ICMPv6 type 130/131 packets
- Unusual ICMPv6 traffic patterns from single sources
SIEM Query:
source="kernel" AND ("out of memory" OR "OOM" OR "memory exhaustion") OR (protocol="ICMPv6" AND (type=130 OR type=131) AND count>threshold)🔗 References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc
- https://security.netapp.com/advisory/ntap-20220425-0001/
- https://www.openwall.com/lists/oss-security/2022/03/15/3
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc
- https://security.netapp.com/advisory/ntap-20220425-0001/
- https://www.openwall.com/lists/oss-security/2022/03/15/3
