Memory leak in Linux kernel - CVE-2022-0742

Vulnerability identifier: #VU61392

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0742

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within igmp6_event_query() and igmp6_event_report() functions in Linux kernel when handling ICMPv6 packets. A remote attacker can flood the system with ICMPv6 messages of type 130 and 131 to cause out-of-memory condition and perform a denial of service (DoS) attack.

Linux kernel
Amazon Linux AMI
Slackware Linux
Ubuntu
linux-image-5.13.0-37-lowlatency (Ubuntu package)
linux-image-5.13.0-37-generic (Ubuntu package)
linux-image-5.13.0-37-generic-lpae (Ubuntu package)
linux-image-5.13.0-37-generic-64k (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-5.13.0-1010-intel (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.13.0-1018-kvm (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.13.0-1019-aws (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.13.0-1021-azure (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-5.13.0-1021-gcp (Ubuntu package)
linux-image-5.13.0-1022-raspi (Ubuntu package)
linux-image-5.13.0-1022-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-5.13.0-1023-oracle (Ubuntu package)
linux-image-5.13.0-1025-oracle (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-oem-20.04c (Ubuntu package)
linux-image-5.14.0-1029-oem (Ubuntu package)
linux-5.15.38/kernel-generic
linux-5.15.38/kernel-headers
linux-5.15.38/kernel-huge
linux-5.15.38/kernel-modules
kernel
linux-image-intel (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.16
linux-image-5.13.0-37-lowlatency (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-generic (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-generic-lpae (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-5.13.0-37-generic-64k (Ubuntu package) - addressed in versions 5.13.0-37.42, 5.13.0-37.42~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.13.0.37.42~20.04.22
linux-image-lowlatency (Ubuntu package) - update to 5.13.0.37.46
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.13.0.37.46, 5.14.0.1029.26
linux-image-generic-lpae (Ubuntu package) - update to 5.13.0.37.46
linux-image-generic (Ubuntu package) - update to 5.13.0.37.46
linux-image-generic-64k (Ubuntu package) - update to 5.13.0.37.46
linux-image-virtual (Ubuntu package) - update to 5.13.0.37.46
linux-image-5.13.0-1010-intel (Ubuntu package) - update to 5.13.0-1010.10
linux-image-intel (Ubuntu package) - update to 5.13.0.1010.11
linux-image-kvm (Ubuntu package) - update to 5.13.0.1018.18
linux-image-5.13.0-1018-kvm (Ubuntu package) - update to 5.13.0-1018.19
linux-image-aws (Ubuntu package) - addressed in versions 5.13.0.1019.20, 5.13.0.1019.21~20.04.12
linux-image-5.13.0-1019-aws (Ubuntu package) - addressed in versions 5.13.0-1019.21, 5.13.0-1019.21~20.04.1
linux-image-gke (Ubuntu package) - update to 5.13.0.1021.19
linux-image-gcp (Ubuntu package) - addressed in versions 5.13.0.1021.19, 5.13.0.1021.25~20.04.1
linux-image-5.13.0-1021-azure (Ubuntu package) - update to 5.13.0-1021.24~20.04.1
linux-image-azure (Ubuntu package) - update to 5.13.0.1021.24~20.04.10
linux-image-5.13.0-1021-gcp (Ubuntu package) - addressed in versions 5.13.0-1021.25, 5.13.0-1021.25~20.04.1
linux-image-5.13.0-1022-raspi (Ubuntu package) - update to 5.13.0-1022.24
linux-image-5.13.0-1022-raspi-nolpae (Ubuntu package) - update to 5.13.0-1022.24
linux-image-raspi (Ubuntu package) - update to 5.13.0.1022.27
linux-image-raspi-nolpae (Ubuntu package) - update to 5.13.0.1022.27
linux-image-oracle (Ubuntu package) - addressed in versions 5.13.0.1023.23, 5.13.0.1025.30~20.04.1
linux-image-5.13.0-1023-oracle (Ubuntu package) - update to 5.13.0-1023.28
linux-image-5.13.0-1025-oracle (Ubuntu package) - update to 5.13.0-1025.30~20.04.1
linux-image-oem-20.04b (Ubuntu package) - update to 5.14.0.1029.26
linux-image-oem-20.04d (Ubuntu package) - update to 5.14.0.1029.26
linux-image-oem-20.04c (Ubuntu package) - update to 5.14.0.1029.26
linux-image-5.14.0-1029-oem (Ubuntu package) - update to 5.14.0-1029.32
linux-5.15.38/kernel-generic - update to 5.15.38
linux-5.15.38/kernel-headers - update to 5.15.38
linux-5.15.38/kernel-huge - update to 5.15.38
linux-5.15.38/kernel-modules - update to 5.15.38
kernel - update to 6.1.10-15.42

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc

• Denial of service in Linux kernel ICMPv6
• Ubuntu update for linux-oem-5.14
• Ubuntu update for linux
• Ubuntu update for linux-azure-5.13
• Slackware Linux update for Slackware 15.0 kernel
• Amazon Linux AMI update for kernel
• Ubuntu update for linux-intel-5.13