CVE-2022-3435

What it actually does

Out-of-bounds read in fib_nh_match within the IPv4 routing handler allows limited memory disclosure over the network.

Why it matters to the business

Attackers may obtain small amounts of kernel memory contents, increasing risk of information exposure on exposed Linux systems; prevalence across distributions and long exposure window heighten operational monitoring costs.

How an attack unfolds

An authenticated remote attacker crafts IPv4 route-related packets that reach fib_nh_match, triggering an out-of-bounds read that leaks limited kernel data; listed threat actors have shown interest in similar Linux kernel memory issues in espionage and financially motivated campaigns.

How to fix it

Apply the upstream patch referenced in VDB-210357 or upgrade to a current Linux kernel release that resolves the fib_nh_match flaw; prioritize systems accepting remote IPv4 route manipulation.

How to confirm the fix worked

Confirm kernel source contains the corrected fib_nh_match bounds check; recompile, boot the updated kernel, and verify the function no longer performs the unchecked read on crafted input.

Typical attack path

1. Identify reachable Linux systems running vulnerable kernels
2. Authenticate with low-privileged credentials
3. Send specially crafted IPv4 routing control messages
4. Observe returned data containing out-of-bounds kernel memory contents

How to detect it

Review kernel logs and network audit trails for unusual IPv4 route manipulation attempts from authenticated sessions; correlate with any process crashes or memory inspection artifacts tied to fib_semantics handling.

What your security team should do

• Inventory all Linux kernel versions across the environment and flag those before the fix
• Apply kernel updates through distribution channels as soon as available
• Restrict low-privileged accounts that can influence IPv4 routing tables until patched
• Monitor EPSS trend and reassess exposure if new exploitation details emerge