CVE-2022-0742

What it actually does

Memory leak in the ICMPv6 implementation allows remote attackers to exhaust kernel memory via repeated transmission of ICMPv6 packets with type 130 or 131, resulting in out-of-memory conditions and denial of service.

Why it matters to the business

Linux hosts running affected kernels can be rendered unavailable, disrupting network services, servers, and infrastructure components that rely on the kernel's networking stack.

How an attack unfolds

An attacker sends a continuous stream of specially crafted ICMPv6 packets of type 130 or 131 to a vulnerable Linux system, triggering incremental memory allocations in the kernel that are never released, eventually exhausting available memory and causing the system to become unresponsive.

How to fix it

Upgrade the Linux kernel to a version containing commit 2d3916f3189172d5c69d33065c3c21119fe539fc or later; apply vendor-supplied kernel updates for all affected distributions.

How to confirm the fix worked

Verify the running kernel version or commit history includes the fix; test by sending ICMPv6 type 130/131 packets in a controlled environment and confirm memory usage remains stable.

Typical attack path

1. Identify reachable Linux hosts running kernel 5.13 or later
2. Craft and transmit ICMPv6 packets with type 130 or 131
3. Repeat transmission at sufficient rate to trigger progressive memory leak
4. Monitor target until kernel memory exhaustion occurs and system becomes unresponsive

How to detect it

Review system logs for repeated ICMPv6 packet processing events, monitor kernel memory counters and OOM killer invocations, and inspect network traffic captures for high volumes of ICMPv6 type 130 or 131 packets directed at Linux hosts.

• ICMPv6 type 130
• ICMPv6 type 131
• oom-killer invocation logs
• kernel memory leak warnings in dmesg

What your security team should do

• Prioritize kernel updates on all exposed Linux systems
• Implement network filtering to drop or rate-limit ICMPv6 packets of type 130 and 131 where operationally feasible
• Monitor memory utilization on Linux hosts for anomalous growth patterns
• Review and apply the latest stable kernel from distribution vendors