CVE-2022-3566

What it actually does

Race condition in tcp_getsockopt and tcp_setsockopt functions within the Linux kernel TCP handler that can lead to inconsistent socket state or memory corruption.

Why it matters to the business

Linux-based systems remain exposed to local attacks that may result in privilege escalation, data disclosure, or service disruption; the issue has been public for over four years with no vendor fixes listed, increasing long-term operational risk across servers and embedded devices.

How an attack unfolds

An attacker with local access creates a TCP socket and issues concurrent getsockopt and setsockopt calls to trigger the race condition in the handler, potentially leading to use-after-free or privilege escalation on affected kernels.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix for the TCP socket option race condition; apply distribution-specific security updates as soon as they become available and rebuild any custom kernels with the patch.

How to confirm the fix worked

Confirm the running kernel version contains the upstream TCP handler fix, review kernel source for the corrected locking around tcp_getsockopt/tcp_setsockopt, and perform regression testing with concurrent socket option workloads.

Typical attack path

1. Gain local user access on a Linux system
2. Create a TCP socket
3. Issue simultaneous tcp_getsockopt and tcp_setsockopt calls
4. Trigger the race condition to corrupt socket state
5. Escalate privileges or crash the system

How to detect it

Search kernel logs and audit trails for repeated socket option calls coinciding with crashes or privilege changes; examine process listings for unexpected local binaries exercising TCP socket APIs around suspicious events.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux systems
• Enforce least-privilege access to limit local attackers
• Monitor kernel logs and auditd for anomalous socket-related errors
• Track EPSS trend and re-assess if exploit maturity increases