CVE-2022-3544

What it actually does

The flaw is a memory leak in damon_sysfs_add_target within the Linux kernel's mm/damon/sysfs.c Netfilter component; repeated calls without proper cleanup exhaust kernel memory.

Why it matters to the business

Linux systems may experience gradual resource exhaustion leading to degraded performance or denial of service for workloads relying on the kernel, increasing operational risk on servers and endpoints.

How an attack unfolds

An attacker with local low-privileged access interacts with the sysfs interface to repeatedly invoke the vulnerable function, triggering incremental memory allocations that are never freed until the system is rebooted or resources are depleted.

How to fix it

Upgrade the Linux kernel to a version containing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f via git log or version string; test that repeated DAMON sysfs target additions no longer increase memory usage.

Typical attack path

1. Obtain local shell or process execution on a vulnerable Linux kernel
2. Locate and write to the DAMON sysfs control files to add targets repeatedly
3. Monitor or trigger kernel memory pressure to accelerate exhaustion
4. Cause system instability or crash when memory is depleted

How to detect it

Review kernel logs for repeated DAMON sysfs operations, monitor for sustained increases in slab or kernel memory allocations without corresponding workload changes, and inspect process activity around sysfs writes.

What your security team should do

• Prioritize patching Linux kernels on internet-facing and high-value systems within standard maintenance windows
• Monitor kernel memory usage metrics for unexplained growth on systems using DAMON
• Restrict untrusted local access and limit use of DAMON sysfs interfaces where possible