CVE-2022-3524: Linux Kernel IPv6 ipv6_renew_options memory leak
A memory leak flaw was found in the Linux kernel’s IPv6 functionality in how a user triggers the setsockopt of the IPV6ADDRFORM and IPV6DSTOPTS type. This flaw allows a user to crash the system if the setsockopt function is being called simultaneously with the IPV6ADDRFORM type and other processes with the IPV6DSTOPTS type. This issue is unlikely to happen unless a local process triggers IPV6ADDRFORM.
Other sources
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6renewoptions of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6renewoptions of the component IPv6 Handler. The manipulation leads to memory leak. The attack potentially can be launched remotely if setsockopt of type IPV6ADDRFORM being used locally. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
Reference: https://vuldb.com/?id.211021
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c52c6bb831f6335c176a0fc7214e26f43adbd11
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-3524?
CVE-2022-3524 is classified as a moderate severity vulnerability due to its impact on system stability.
How do I fix CVE-2022-3524?
To fix CVE-2022-3524, update your Linux kernel to a version that contains the security patch, such as 0:4.18.0-477.10.1.el8_8 or later.
What systems are affected by CVE-2022-3524?
CVE-2022-3524 affects various versions of the Linux kernel, particularly those prior to the patched releases specified in the advisory.
What type of vulnerability is CVE-2022-3524?
CVE-2022-3524 is a memory leak vulnerability found in the Linux kernel's IPv6 functionality.
Can CVE-2022-3524 be exploited remotely?
CVE-2022-3524 can potentially be exploited by a local user to crash the system, impacting its availability.