CVE-2022-1353

What it actually does

A flaw in the pfkey_register function in net/key/af_key.c allows a local unprivileged user to access kernel memory, resulting in disclosure of internal kernel information or a system crash.

Why it matters to the business

Local users on Linux systems can trigger crashes that disrupt operations or leak sensitive kernel data that may enable further attacks; prevalence in the torvalds/linux ecosystem increases exposure across many deployments.

How an attack unfolds

An attacker with local unprivileged access invokes pfkey_register to trigger the memory access flaw, reading leaked kernel internals or causing a crash; no named threat actors have been observed exploiting this specific issue.

How to fix it

Update the Linux kernel to a version containing commit 9a564bccb78a76740ea9d75a259942df8143d02c or later; apply distribution-specific backports where available.

How to confirm the fix worked

Confirm the presence of commit 9a564bccb78a76740ea9d75a259942df8143d02c in the kernel source tree or verify deployment of patched kernel packages via package manager queries.

Typical attack path

1. Obtain local unprivileged shell access on an affected Linux system
2. Invoke the pfkey_register function in a way that triggers the flaw
3. Read disclosed kernel memory or observe system crash

How to detect it

Inspect kernel logs for oops, panics, or warnings referencing af_key or pfkey_register; correlate with unusual local process activity around the time of any incidents.

What your security team should do

• Prioritize kernel updates on any system exposing local user access
• Review and restrict unnecessary local accounts
• Monitor kernel logs for related crashes