CVE-2022-3646

What it actually does

The flaw in nilfs_attach_log_writer within fs/nilfs2/segment.c allows an attacker to trigger a memory leak through crafted input to the BPF component, gradually exhausting kernel memory resources without releasing allocated structures.

Why it matters to the business

Systems running affected Linux kernels may experience gradual performance degradation or denial of service under sustained load, increasing operational costs and risk of unplanned downtime on file-system-dependent workloads; the issue affects widely used kernel code but carries low urgency given its age and lack of active exploitation.

How an attack unfolds

An attacker with low-privileged remote access crafts specific inputs that invoke nilfs_attach_log_writer, causing repeated allocation without corresponding deallocation; over time this leads to memory pressure that can impair system stability, though no public exploit code or named threat actor campaigns have materialized since disclosure.

How to fix it

Upgrade to fixed kernel versions or apply the referenced patch (e.g., commit d0ffa05fe8b8fb258d6c177ff0427dd71d7d5210 for quarkusio/quarkus); Ubuntu users should install mysql-8.0 packages 8.0.27-0ubuntu0.20.04.1 or 8.0.27-0ubuntu0.21.10.1 as appropriate for their release; verify the update resolves the memory-leak path in segment.c.

How to confirm the fix worked

Confirm the running kernel and package versions match or exceed the listed fixed releases, then exercise NILFS2/BPF workloads while monitoring kernel memory counters for leaks; review changelog entries for segment.c to verify the allocation fix is present.

Typical attack path

1. Obtain low-privileged remote access to a target system running an affected kernel with NILFS2 support
2. Identify or trigger code paths that call nilfs_attach_log_writer via the BPF subsystem
3. Repeatedly submit crafted inputs that allocate kernel memory without release
4. Monitor for memory exhaustion symptoms that impact availability

How to detect it

Review kernel logs and memory usage statistics for sustained growth without corresponding workload increases; look for repeated invocations of nilfs_attach_log_writer in traces or audit records on systems that have not yet been patched.

What your security team should do

• Prioritize patching Linux kernels on any systems that expose NILFS2 or BPF interfaces, even with low EPSS, to eliminate the memory-leak vector
• Monitor upstream kernel advisories for backports to older supported releases
• Limit untrusted local or remote access to BPF and file-system operations until patches are applied