CVE-2022-3524

What it actually does

The vulnerability causes a memory leak in the ipv6_renew_options function of the Linux kernel IPv6 handler when processing certain inputs, allowing repeated allocation without corresponding deallocation.

Why it matters to the business

Linux-based systems may experience gradual memory exhaustion leading to degraded performance or denial of service over time when handling IPv6 traffic; the issue has been public for over three years with low exploitation probability and no known ransomware use.

How an attack unfolds

An attacker sends specially crafted remote IPv6 packets that trigger the ipv6_renew_options path repeatedly; each invocation leaks a small amount of kernel memory until system resources are depleted.

How to fix it

Update the Linux kernel to include commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 or later; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit via git log or version string checks; monitor memory usage under sustained IPv6 option traffic to verify absence of leaks.

Typical attack path

1. Identify Linux systems exposing IPv6 interfaces
2. Craft and transmit malformed IPv6 option packets targeting the renew_options handler
3. Repeat transmission to accumulate leaked memory allocations
4. Monitor for system slowdown or OOM conditions resulting from exhaustion

How to detect it

Examine kernel logs and memory statistics for repeated allocation patterns without matching frees during IPv6 processing; correlate with network traffic containing unusual IPv6 options.

What your security team should do

• Prioritize patching production Linux systems handling IPv6 within standard maintenance windows
• Review IPv6 exposure and apply network segmentation where immediate patching is not feasible
• Monitor kernel memory metrics for anomalous growth patterns on unpatched hosts