CVE-2022-3624

What it actually does

Memory leak in the rlb_arp_xmit function within the Linux kernel bonding driver (bond_alb.c) when handling IPsec-related ARP transmissions, causing gradual kernel memory exhaustion without freeing allocated buffers.

Why it matters to the business

Over time, affected Linux systems may experience degraded performance, instability, or denial of service due to memory pressure, increasing operational overhead for systems relying on network bonding in IPsec environments.

How an attack unfolds

An attacker with local access crafts or triggers network conditions that invoke the vulnerable ARP transmit path in the bonding driver, repeatedly causing allocations that are never freed, leading to cumulative memory loss.

How to fix it

Apply the upstream patch referenced under VDB-211928 or upgrade to a Linux kernel version that resolves the memory leak in drivers/net/bonding/bond_alb.c; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Verify the updated kernel contains the fix for rlb_arp_xmit, confirm via code review or memory profiling that allocations in the bonding ARP path are properly released, and test under load with IPsec and bonding enabled.

Typical attack path

1. Obtain local user access on a Linux system using network bonding
2. Perform or induce IPsec-related ARP operations that exercise the rlb_arp_xmit code path
3. Repeat triggering to accelerate memory consumption until system impact occurs

How to detect it

Review system logs and kernel memory statistics for sustained increases in bonding-related allocations; correlate with processes performing IPsec or ARP activity on bonded interfaces.

What your security team should do

• Prioritize kernel updates on systems using network bonding with IPsec
• Monitor kernel memory usage and slab allocator statistics for anomalous growth
• Restrict local access where possible to reduce attack surface