CVE-2022-1678

What it actually does

Improper sock reference counting during TCP pacing in the Linux kernel (versions 4.18-4.19) causes a memory and network namespace leak that remote clients can trigger repeatedly.

Why it matters to the business

Systems may exhaust memory or network resources leading to degraded performance, service disruption, or crashes; the issue affects core networking in widely deployed Linux kernels and some dependent packages.

How an attack unfolds

An attacker sends a sequence of TCP packets that exercise the pacing code path; each interaction fails to release a socket reference, accumulating leaks until the target experiences resource pressure or denial of service.

How to fix it

Upgrade torvalds/linux to commit 0a70f118475e037732557796accd0878a00fc25a or later; upgrade affected chromium packages on Debian 11 to version 108.0.5359.94-1~deb11u1 or newer; apply vendor kernel updates as soon as available.

How to confirm the fix worked

Confirm the running kernel version is outside 4.18-4.19 or contains the referenced commit; test that repeated TCP pacing workloads no longer produce measurable memory or netns growth.

Typical attack path

1. Identify a reachable Linux host running an affected kernel version
2. Establish TCP connections and send traffic designed to invoke pacing logic
3. Repeat the interaction to accelerate reference-count leakage
4. Monitor for memory or netns exhaustion that impacts availability

How to detect it

Review kernel logs and memory usage metrics for unexpected growth correlated with TCP connection volume; look for netns or socket reference leaks via standard system monitoring tools.

What your security team should do

• Prioritize patching internet-facing systems and those handling high TCP connection volumes
• Monitor vendor advisories for backported fixes in supported distributions
• Apply network segmentation or rate limiting as temporary mitigation where upgrades are delayed