CVE-2022-28356

What it actually does

Refcount leak in net/llc/af_llc.c allows improper reference counting on LLC sockets, enabling memory corruption or use-after-free conditions when sockets are released.

Why it matters to the business

Local attackers can trigger denial of service on Linux systems, causing crashes or resource exhaustion that disrupts operations; high ecosystem prevalence increases patch urgency across servers and devices.

How an attack unfolds

An attacker with local access crafts LLC socket operations to trigger the refcount leak, leading to use-after-free during socket cleanup that can be leveraged for kernel memory corruption or crashes; known threat actor interest in Linux kernel memory issues suggests potential for targeted local privilege escalation attempts.

How to fix it

Upgrade Linux kernel to version 5.17.1 or later containing commit 764f4eb6846f5475f1244767d24d25dd86528a4a; apply vendor backports for supported distributions and reboot affected systems.

How to confirm the fix worked

Verify kernel version is at least 5.17.1; inspect net/llc/af_llc.c for the refcount fix and confirm no duplicate references remain on socket close paths.

Typical attack path

1. Obtain local user access on target Linux system
2. Create and manipulate LLC sockets to induce refcount leak
3. Trigger socket release path to cause use-after-free or corruption
4. Exploit resulting memory state for denial of service or further escalation

How to detect it

Review kernel logs for LLC socket-related crashes or refcount warnings around the time of suspected activity; examine audit logs for unusual socket creation patterns by local processes.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux hosts within 30 days given exploit availability
• Monitor for local privilege escalation attempts post-patch
• Restrict untrusted local user access until mitigated