CVE-2022-32296

What it actually does

The Linux kernel's TCP source port selection uses a predictable double-hash algorithm that allows local observers to correlate connections to specific clients based on chosen ports.

Why it matters to the business

Organizations running older kernels face increased risk of client tracking or information leakage in shared or multi-tenant environments, with low but non-zero probability of exploitation as indicated by EPSS trends; widespread Linux kernel usage amplifies potential exposure across servers and endpoints.

How an attack unfolds

A local attacker with limited privileges monitors TCP port allocations on the system and leverages the deterministic behavior of the double-hash port selection to link source ports back to individual client processes or sessions.

How to fix it

Upgrade the Linux kernel to version 5.17.9 or later; apply commit 4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 from the mainline git repository to change the port selection algorithm.

How to confirm the fix worked

Verify the running kernel version is 5.17.9 or newer; inspect source port randomization behavior post-upgrade to confirm use of a non-predictable algorithm; review system logs for successful kernel updates.

Typical attack path

1. Obtain limited local access on a Linux system running a vulnerable kernel
2. Observe active TCP connections and their source port assignments
3. Apply knowledge of the double-hash algorithm to map ports to specific clients
4. Correlate observed ports across multiple connections to identify or track clients

How to detect it

Review kernel logs and system audit records for unexpected local process activity monitoring network connections; correlate with any reports of client identification attempts, though specific artifacts are limited due to the passive nature of the flaw.

What your security team should do

• Prioritize kernel upgrades on all affected Linux systems to 5.17.9 or later within standard patch cycles
• Monitor EPSS and threat intelligence for any increase in exploitation activity
• Audit environments for legacy kernel deployments and schedule targeted updates