CVE-2022-0382

What it actually does

The flaw allows a local user to read up to 7 bytes of uninitialized kernel memory by sending a TIPC datagram to one or more destinations in the Linux kernel's TIPC protocol subsystem.

Why it matters to the business

Local attackers on affected Linux systems may obtain limited kernel memory contents that could assist in developing further exploits, though the small fixed size and lack of control reduce direct data theft risk; impacts organizations running older kernels with TIPC enabled.

How an attack unfolds

An attacker with local access on a vulnerable Linux system sends a specially crafted TIPC datagram, causing the kernel to return uninitialized memory bytes without proper clearing or bounds enforcement.

How to fix it

Upgrade the Linux kernel to a version containing commit d6d86830705f173fca6087a3e67ceaf68db80523 or any release at or beyond 5.17-rc1.

How to confirm the fix worked

Confirm the running kernel version is 5.17-rc1 or newer; inspect git history for the presence of commit d6d86830705f173fca6087a3e67ceaf68db80523 in the TIPC source files.

Typical attack path

1. Gain local user access on a Linux host running a vulnerable kernel
2. Locate or enable TIPC protocol support
3. Transmit a TIPC datagram targeting one or more destinations
4. Capture and inspect the returned kernel memory bytes

How to detect it

Examine system and kernel logs for TIPC datagram transmissions by non-privileged processes; review audit trails for unusual protocol usage patterns around the time of suspected activity.

What your security team should do

• Apply kernel updates containing the referenced commit across all affected systems
• Disable TIPC if not required for operations
• Review and restrict local user privileges
• Monitor kernel and audit logs for anomalous TIPC activity