CVE-2021-22600

What it actually does

CVE-2021-22600 is a Linux kernel memory corruption flaw in packet_set_ring() in net/packet/af_packet.c. A local low-privileged user can trigger a double free through crafted AF_PACKET socket/ring setup syscalls, potentially corrupting kernel memory. Successful exploitation can allow local privilege escalation to kernel/root-level privileges or crash the system, causing denial of service. Exploitation requires local code execution and is higher complexity, but it is confirmed as exploited in the wild and listed in CISA KEV.

Why it matters to the business

An attacker who already has limited access to a Linux-based system can potentially gain full control of that system or crash it. This is especially important for multi-user Linux servers, container hosts, appliances, and environments where untrusted users or workloads can execute local code. Because the vulnerability is in the kernel, compromise can bypass many application-level controls and may affect downstream products and appliances that embed vulnerable Linux kernels, including affected Debian, NetApp H-series firmware, and other Linux-derived distributions. The CISA KEV remediation deadline was 2022-05-02, so remaining exposure should be treated as overdue and high priority.

How an attack unfolds

An attacker first obtains a local foothold, such as shell access, the ability to run a process, or execution inside a workload on a vulnerable Linux-based system. The attacker then uses crafted syscalls against the AF_PACKET networking subsystem to manipulate packet socket ring configuration in a way that triggers the double free in packet_set_ring(). If the attacker can shape the resulting kernel memory corruption reliably, they may overwrite or influence kernel structures to elevate privileges to root or kernel-equivalent control. Failed attempts may cause kernel warnings, crashes, or reboots. Public exploitation has been observed, and the vulnerability is tracked in KEV, so defenders should assume exploit code may be available or incorporated into post-compromise tooling.

How to fix it

Upgrade to a kernel or vendor firmware release that contains the fix for the AF_PACKET double free, including or superseding upstream Linux kernel commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755. Use distribution- and appliance-specific security advisories for exact package names and versions, especially for Debian and embedded NetApp H-series firmware. Reboot systems after kernel or firmware updates so the fixed kernel is actually running. Where immediate patching is not possible, reduce exploitability by disabling unprivileged user namespaces where operationally acceptable, restricting CAP_NET_RAW, applying seccomp/AppArmor/SELinux controls that block untrusted use of AF_PACKET sockets, preventing untrusted local shell or container execution, and isolating high-risk multi-user systems. Mitigations should be considered temporary; kernel update and reboot are the durable fix.

How to confirm the fix worked

Confirm exposure by checking the running kernel version, not only the installed package version. On Linux systems, compare `uname -a`, distribution package metadata, and vendor advisories to verify the running kernel includes the fix for ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 or a later backport. Confirm the host has been rebooted after patching. For appliances, verify the installed firmware version against the vendor advisory. Validate mitigations by confirming unprivileged user namespaces are disabled where intended, untrusted processes cannot create AF_PACKET sockets, and container/seccomp profiles restrict packet socket use. Kernel logs should no longer show crashes or warnings referencing AF_PACKET, packet_set_ring, or net/packet/af_packet.c after remediation.

Typical attack path

1. Gain local code execution on a vulnerable Linux-based host, appliance, or workload.
2. Check kernel version, distribution build, and whether AF_PACKET/user namespace conditions make exploitation viable.
3. Invoke crafted socket and ring-management syscalls targeting the AF_PACKET implementation in net/packet/af_packet.c.
4. Trigger the double free in packet_set_ring() and attempt to corrupt kernel memory in a controlled way.
5. Escalate privileges to root or kernel-level control, or crash the host if exploitation is unstable.
6. Use elevated privileges to disable defenses, dump credentials, deploy persistence, pivot laterally, or modify system data.

How to detect it

Detection is difficult because successful exploitation occurs inside kernel memory and may leave few direct artifacts. Focus on three areas: kernel fault evidence, local privilege escalation behavior, and suspicious use of packet sockets by untrusted processes. Review `dmesg`, `/var/log/kern.log`, `/var/log/messages`, systemd journal kernel logs, appliance crash logs, vmcore/kdump artifacts, EDR telemetry, and auditd logs. Look for kernel oops, BUG, panic, general protection fault, use-after-free, double-free, or slab allocator corruption messages referencing AF_PACKET, packet_set_ring, packet_setsockopt, packet_mmap, or net/packet/af_packet.c. If auditd or eBPF syscall telemetry is available, hunt for low-privileged processes creating AF_PACKET sockets or invoking packet ring setup operations shortly before a privilege change, crash, or new root-owned process. Also look for post-exploitation indicators: unexpected UID 0 shells, suspicious setuid binaries, new privileged accounts, modified sudoers configuration, disabled endpoint tooling, abnormal kernel module loads, or unexplained reboots. Named threat-actor labels associated with this record describe Linux/Android kernel privilege-escalation exploitation patterns rather than a single unique intrusion set, so detections should focus on local kernel exploitation and post-escalation activity.

• packet_set_ring
• net/packet/af_packet.c
• af_packet.c
• AF_PACKET
• packet_setsockopt
• packet_mmap
• kernel BUG at net/packet/af_packet.c
• BUG: kernel NULL pointer dereference
• general protection fault
• kernel panic
• Oops:
• double free
• use-after-free
• slab corruption
• corrupted double-linked list
• skb_over_panic
• sock: process
• socket(AF_PACKET
• CAP_NET_RAW
• unprivileged_userns_clone

What your security team should do

• Prioritize patching and rebooting internet-adjacent, multi-user, container-hosting, CI/CD, shared development, and appliance systems running affected Linux kernels.
• Treat this as overdue if still present because it is CISA KEV-listed with a remediation due date of 2022-05-02 and has active in-the-wild exploitation maturity.
• Inventory Linux distributions, embedded appliances, and firmware products that may include vulnerable kernels, including Debian and affected NetApp H-series products.
• Where patching is delayed, disable unprivileged user namespaces if possible and restrict AF_PACKET socket creation by untrusted users or workloads using capabilities, seccomp, AppArmor, SELinux, or container runtime policy.
• Review recent kernel logs, audit logs, EDR telemetry, and crash dumps for signs of AF_PACKET-related kernel faults or suspicious local privilege escalation activity.
• Hunt for post-exploitation behavior following possible local privilege escalation, including unexpected root shells, new privileged users, modified sudoers files, disabled security tools, or unexplained kernel crashes.
• Ensure vulnerability scanners verify the running kernel after reboot rather than relying only on installed package inventory.