CVE-2022-4269

What it actually does

A local unprivileged user can trigger an ABBA deadlock in the Linux kernel TC subsystem by redirecting egress packets to ingress via the mirred action; retransmissions on TCP or SCTP then cause a CPU soft lockup resulting in denial of service.

Why it matters to the business

Systems may become unresponsive, disrupting network services and requiring manual intervention or reboot to restore availability.

How an attack unfolds

An attacker with local access configures a TC mirred redirect from egress to ingress, then induces a transport-layer retransmission on TCP or SCTP to trigger the deadlock and soft lockup.

How to fix it

Update the Linux kernel to a version containing the fix for the TC mirred deadlock; if no vendor patch is yet available, restrict unprivileged local access and avoid mirred redirect configurations until a patched kernel can be deployed.

How to confirm the fix worked

Verify the running kernel version against vendor advisories; attempt to reproduce the mirred configuration and retransmission scenario in a test environment to confirm the lockup no longer occurs.

Typical attack path

1. Obtain local unprivileged shell access
2. Install or invoke tc to create a mirred egress-to-ingress redirect rule
3. Generate traffic that triggers TCP or SCTP retransmission
4. Observe CPU soft lockup and resulting denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for repeated soft lockup or watchdog messages; inspect active tc filter and action configurations for unexpected mirred redirects.

• watchdog: BUG: soft lockup
• tc filter add ... action mirred
• ABBA deadlock

What your security team should do

• Prioritize kernel updates on all affected Linux systems
• Limit local unprivileged accounts where possible
• Audit existing tc configurations for mirred rules
• Monitor for soft-lockup kernel messages until patches are applied