CVE-2022-3567

What it actually does

A race condition in the inet6_stream_ops and inet6_dgram_ops functions of the IPv6 handler allows concurrent operations on shared kernel structures without adequate synchronization, enabling memory corruption or inconsistent state.

Why it matters to the business

Systems running vulnerable Linux kernels may experience service disruptions or limited information exposure when handling IPv6 network traffic, affecting availability of networked applications and requiring unplanned maintenance windows.

How an attack unfolds

An attacker on the same network segment crafts and sends timed IPv6 packets to trigger the race condition in the kernel's IPv6 handler, potentially leading to memory corruption that can be leveraged for limited impact.

How to fix it

Update the Linux kernel to a version containing the patch for the IPv6 handler race condition; apply vendor-supplied kernel updates as they become available and rebuild any custom kernels with the fix incorporated.

How to confirm the fix worked

Confirm the updated kernel version is deployed across affected hosts, perform IPv6 connectivity and load tests to verify stability, and review kernel source or changelog entries confirming the synchronization fix.

Typical attack path

1. Locate systems exposing IPv6 services on the local network segment
2. Identify Linux kernel versions susceptible to the race condition
3. Transmit concurrent IPv6 stream and datagram packets with precise timing
4. Trigger the race to induce memory corruption or kernel instability

How to detect it

Examine kernel logs and system crash dumps for IPv6 handler faults or race-related warnings; correlate with network flow data showing high volumes of IPv6 packets around the time of anomalies.

What your security team should do

• Apply kernel updates to all Linux systems with IPv6 enabled as highest priority
• Temporarily disable IPv6 on non-essential systems until patches are applied
• Monitor network traffic for anomalous IPv6 packet patterns during the patching window
• Review and enforce network segmentation to limit local attacker reach