CVE-2022-3533

What it actually does

Memory leak in parse_usdt_arg within tools/lib/bpf/usdt.c triggered by crafted reg_name input, resulting in unreleased allocations and gradual memory exhaustion affecting availability.

Why it matters to the business

Over extended periods on systems using BPF USDT tracing, resource exhaustion may cause performance degradation or service disruption; low exploitability and four-year-old publication with minimal EPSS trend reduce immediate operational risk.

How an attack unfolds

An attacker with local network-adjacent access supplies a malicious register name to the parse_usdt_arg function, inducing repeated allocations without corresponding frees; sustained triggering leads to kernel memory depletion and potential denial of service.

How to fix it

Update the Linux kernel to incorporate commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c which resolves the leak in tools/lib/bpf/usdt.c; rebuild and deploy affected packages from the fixed git revision.

How to confirm the fix worked

Verify the running kernel source contains commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c; monitor memory usage under BPF USDT workloads and confirm absence of incremental leaks via kernel memory profiling tools.

Typical attack path

1. Obtain local or adjacent access to a Linux system running the vulnerable kernel
2. Invoke or trigger BPF USDT tracing paths that reach parse_usdt_arg
3. Supply crafted reg_name values to cause allocation without release
4. Repeat to accumulate leaked memory until system impact occurs

How to detect it

Review system logs for unusual memory growth correlated with BPF USDT activity; inspect kernel memory statistics and process accounting for sustained allocation patterns without corresponding deallocations.

What your security team should do

• Prioritize kernel updates containing the referenced commit on systems utilizing BPF tracing
• Audit deployment pipelines for custom kernel builds and apply the fix
• Monitor EPSS and KEV updates for any future increase in observed exploitation