CVE-2022-1012

What it actually does

Memory leak in TCP source port generation algorithm in net/ipv4/tcp.c caused by insufficient perturb table size, enabling information disclosure and denial of service via resource exhaustion.

Why it matters to the business

Unpatched Linux systems may suffer gradual memory depletion leading to degraded network performance, service outages, or crashes, with risk of sensitive network data exposure; the issue has been public for over four years with low but rising exploit probability.

How an attack unfolds

An attacker repeatedly initiates TCP connections or sends packets that trigger source port allocation in the kernel, causing incremental memory leaks over time that can disclose kernel memory contents or exhaust resources resulting in denial of service.

How to fix it

Upgrade the Linux kernel to include commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f which enlarges the perturb table; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f, inspect net/ipv4/tcp.c for the enlarged perturb table, and test memory stability under sustained TCP connection load.

Typical attack path

1. Establish repeated TCP connections or send crafted packets to the target Linux system
2. Trigger source port generation repeatedly to induce memory allocations
3. Observe increasing memory usage or attempt to read leaked kernel data
4. Continue until resource exhaustion causes service degradation or crash

How to detect it

Review kernel logs for repeated memory allocation patterns in the TCP stack, monitor /proc/meminfo and slabinfo for unexpected growth in network-related structures, and analyze network connection rates for unusual sustained activity.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all internet-facing and internal Linux hosts
• Monitor kernel memory statistics and network subsystem usage for anomalies
• Apply network segmentation to limit exposure until patches are deployed