Loading vulnerability…
CVE-2022-0435 is a stack-based out-of-bounds write in the Linux kernel Transparent Inter-Process Communication (TIPC) networking implementation, present since Linux kernel 4.8. The flaw arises when processing a TIPC domain record that declares more than the maximum supported 64 member nodes, causing packet data to overflow a fixed-size stack buffer. An attacker able to send crafted traffic through a reachable TIPC network can trigger the condition.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working local Linux kernel privilege-escalation exploit for CVE-2022-0435 (TIPC stack overflow) with KASLR support. Structure: - README.md: Environment/setup steps (Ubuntu 22.04.5 ISO, install and boot kernel 5.13.0-051300-generic, load TIPC module, run leak.py to obtain kernel base, then run exploit with that base). Claims successful root. - exploit.c: Main exploit. It enables TIPC UDP media via generic netlink (AF_NETLINK/NETLINK_GENERIC), sets up a TIPC link over UDP (port 6118), constructs a crafted payload that triggers the vulnerable TIPC stack overflow, and uses a kernel ROP chain to call commit_creds(init_cred) to become root. It supports KASLR by taking a leaked kernel base address as argv[1] and computing KASLR_SLIDE = leaked_base - 0xffffffff81000000, then adding the slide to hardcoded symbol/gadget offsets (specific to kernel 5.13.0-generic). After sending the overflow trigger, it runs system("/bin/sh"). - leak.py: Helper that (via sudo) extracts the address of _stext from /proc/kallsyms to provide the kernel base for the exploit. Key capabilities: - KASLR bypass (assumes kallsyms readable with sudo) and dynamic relocation of ROP chain. - Kernel ROP chain for privilege escalation (commit_creds(init_cred)). - Network-facing component is local TIPC-over-UDP traffic generation to the host (TIPC bearer), not a remote exploit as written; it requires local privileges to configure TIPC and to obtain the leak. Notable constraints/assumptions: - Hardcoded offsets/gadgets are kernel-version dependent; README and comments indicate kernel 5.13.0-generic. - Requires TIPC module/bearer enabled and sufficient privileges (sudo) to configure TIPC and read kallsyms in the provided workflow.
Repository contains a single C exploit (exploit.c) plus minimal metadata (.gitignore, LICENSE, README.md). The code is an operational local privilege escalation exploit for CVE-2022-0435 (Linux kernel TIPC stack overflow). It creates a UDP socket and targets the TIPC-over-UDP listener on 127.0.0.1:6118, first sending a discovery/link setup packet and then sending crafted records intended to trigger a stack overflow in the TIPC protocol handling. Key capabilities implemented in exploit.c: - Local TIPC link setup over UDP loopback (no external network targeting). - KASLR bypass via a local info leak (function get_kernel_addresses() is present but truncated in the provided content), then computes kernel symbol/gadget addresses using hardcoded offsets (commit_creds, prepare_kernel_cred, pop rdi/rsi, swapgs, iretq). - Builds a kernel ROP chain to elevate privileges (prepare_kernel_cred(0) -> commit_creds()) and return safely to userland. - Uses Linux namespaces and writes to /proc/self/{uid_map,setgroups,gid_map} to prepare the environment; also runs system commands to load the tipc module and bring loopback up. - After triggering, it waits briefly and attempts to spawn a root shell (get_root_shell()). Overall purpose: provide a standalone PoC/operational exploit for local root on vulnerable Linux kernels by exploiting the TIPC stack overflow via localhost UDP traffic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote Linux kernel stack-overflow issue affecting systems using TIPC that may cause a kernel panic and denial of service.
A Linux kernel remote stack-overflow vulnerability affecting systems using TIPC that may cause denial of service through a kernel panic.
A remote Linux kernel stack-overflow vulnerability affecting systems using TIPC; it may trigger a kernel panic and denial of service.
A Linux kernel TIPC-related remote stack overflow that can cause a kernel panic and denial of service.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.