CVE-2022-21499

What it actually does

KGDB and KDB debuggers fail to enforce kernel lockdown restrictions, permitting an attacker with serial port access to read from and write to arbitrary kernel memory locations.

Why it matters to the business

Attackers with physical or console access can fully compromise affected Linux kernel instances, leading to data theft, system control, and service disruption on servers or embedded devices.

How an attack unfolds

An attacker connects to an exposed serial console on a locked-down Linux system, triggers the kernel debugger interface, and uses the resulting read/write primitives to alter kernel structures or extract sensitive data without triggering lockdown protections.

How to fix it

Apply the latest kernel updates from Oracle Linux or Debian that enforce lockdown mode for KGDB/KDB; restrict physical and serial console access; disable unnecessary debugging interfaces in production kernels.

How to confirm the fix worked

Verify kernel lockdown status via /sys/kernel/security/lockdown and confirm debugger entry points reject operations when lockdown is active; test serial console access after updates.

Typical attack path

1. Obtain local serial port or console access to the target system
2. Trigger entry into KGDB or KDB debugger mode
3. Bypass lockdown checks to perform arbitrary kernel memory operations
4. Escalate to full kernel control or data exfiltration

How to detect it

Review system and kernel logs for unexpected debugger activations or serial console sessions; inspect audit records for lockdown bypass attempts or kernel memory access patterns from privileged local processes.

What your security team should do

• Prioritize kernel updates on all exposed Oracle Linux and Debian systems
• Audit and restrict serial/console access policies immediately
• Disable KGDB/KDB in production kernel configurations where possible
• Monitor for new kernel releases addressing debugger lockdown enforcement