Loading vulnerability…
Linux Kernel Open vSwitch Nested Actions Memory Leak
CVE-2022-49086 is a missing-release-of-memory flaw in the Linux kernel Open vSwitch module. While parsing user-provided Open vSwitch actions, the module dynamically allocates state for certain actions, including connection-tracking and set actions. The flow-action cleanup routine did not recursively process nested action lists, such as those within clone or sample actions, causing allocated action state to remain unreleased when the flow was removed. Unreleased set actions could also retain tunnel destination structures and associated device references.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker or local user able to create and rotate affected Open vSwitch flows can cause kernel memory to leak. At a sufficiently high flow-rotation rate, the leak can materially degrade system performance and exhaust memory resources, potentially causing a denial of service. The reported case observed leakage at approximately 2 MB per second.
If you can’t patch tonight, do this now.
No reliable operational mitigation is identified. Reducing high-rate Open vSwitch datapath-flow creation and removal may reduce memory-leak accumulation, but this may be difficult because users may not directly control flows generated by Open vSwitch. Applying a fixed kernel is the recommended resolution.
Patch, then assume compromise.
Install a Linux kernel update containing the Open vSwitch nested-action cleanup fix, which recursively iterates through nested actions and releases their allocated resources. For affected Red Hat Enterprise Linux deployments, fixes were issued through RHSA-2022:5626 for RHEL 8.4 Extended Update Support, RHSA-2022:7683 for RHEL 8, RHSA-2022:8267 for RHEL 9, and RHSA-2022:8973 for RHEL 9.0 Extended Update Support. Reboot after installing the updated kernel so that the fixed kernel is running.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.