Loading vulnerability…
Remote stack buffer overflow in Linux kernel TIPC
CVE-2022-0435 is a stack-based buffer overflow in the Linux kernel's Transparent Inter-Process Communication (TIPC) networking implementation, present since Linux 4.8. A crafted TIPC packet declaring more than the permitted 64 domain-member nodes can overflow a stack buffer. An attacker with access to the TIPC network can trigger a kernel panic and potentially execute code or escalate privileges, depending on kernel hardening. Stricter FORTIFY_SOURCE memcpy() bounds checking turns the overflow into a kernel panic; without those checks, code execution may be possible if stack-canary protection can be bypassed or is disabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the entire host through a kernel panic, disrupting all hosted services. On kernels without the stricter copy bounds checks, exploitation may permit arbitrary code execution in kernel context and privilege escalation, potentially compromising system confidentiality, integrity, and availability. Code execution additionally depends on overcoming stack-canary protection when enabled.
If you can’t patch tonight, do this now.
Disable TIPC and prevent its kernel module from loading when the protocol is unnecessary. If the module is already loaded and cannot be safely unloaded because TIPC is active, restart the system after configuring module-load prevention. Where TIPC is required, restrict network access to trusted nodes and encrypt and authenticate inter-node communications using TIPC encryption or transport protections such as IPsec or MACsec. FORTIFY_SOURCE bounds checking limits the documented exploitation outcome to a kernel panic but does not prevent denial of service.
Patch, then assume compromise.
Install the distribution-supported kernel or kernel-rt update addressing CVE-2022-0435 and reboot into the fixed kernel. Applicable Red Hat fixes include kernel 4.18.0-348.20.1.el8_5 under RHSA-2022:0825, 4.18.0-305.40.1.el8_4 under RHSA-2022:0777, and 4.18.0-193.80.1.el8_2 under RHSA-2022:1213, or later supported fixed builds. Supported deployments may alternatively apply the matching Red Hat kpatch-patch update, such as RHSA-2022:0849, RHSA-2022:0772, or RHSA-2022:1186, to patch the running kernel without a conventional reboot. Use the advisory appropriate to the installed product, architecture, and support stream.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.