Loading vulnerability…
Linux Kernel TCP Source-Port Generation Information Disclosure
CVE-2022-1012 is an information-disclosure vulnerability in the Linux kernel's TCP source-port generation algorithm, with core selection logic implemented in __inet_hash_connect(). An undersized perturbation table in the Double-Hash Port Selection Algorithm allows attackers observing source ports to infer the evolution of internal port-selection state. This enables system fingerprinting and inference of outbound TCP connection patterns. The global table is shared across network interfaces and namespaces, allowing information leakage across those boundaries. Fingerprinting can distinguish systems with otherwise identical hardware and software until restart. Despite early descriptions, the vulnerability is not a memory leak or denial-of-service flaw.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation exposes limited TCP-stack state and network-activity information, enabling persistent device fingerprinting and estimation of the number of outgoing TCP connections within a time window. Shared perturbation state can leak information across network interfaces and namespaces. Red Hat ultimately characterized the impact as limited information disclosure, rather than memory leakage or denial of service. No integrity compromise, privilege escalation, or code execution is established.
If you can’t patch tonight, do this now.
Red Hat identifies no workaround meeting its criteria for ease of deployment, broad applicability, and stability. Restarting resets the fingerprinting state but does not remove the vulnerability and is not a substitute for patching.
Patch, then assume compromise.
Install the vendor-fixed kernel or kernel-rt package for the applicable distribution and support channel, then reboot into the updated kernel. RHEL fixes include kernel 4.18.0-193.87.1.el8_2 for RHEL 8.2, 4.18.0-305.57.1.el8_4 for RHEL 8.4, and 4.18.0-372.19.1.el8_6 for RHEL 8.6. RHEL 9 fixes are available through RHSA-2022:5249 and RHSA-2022:5267; supported running kernels can alternatively receive the applicable live patch through RHSA-2022:5214 without a conventional reboot. The upstream fix series increases the perturbation table to 65,536 entries and uses all 64 bits of SipHash for port-offset calculation. RHEL 7 is unaffected because it uses a different port-selection algorithm.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.