CVE-2022-0742: Linux Kernel ICMPv6 DoS Vulnerability

CVE-2022-0742 Overview

CVE-2022-0742 is a memory leak vulnerability in the ICMPv6 implementation within the Linux Kernel versions 5.13 and later. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) condition by exhausting system memory through specially crafted ICMPv6 packets. The flaw specifically affects the handling of ICMPv6 type 130 (Multicast Listener Query) and type 131 (Multicast Listener Report) messages, which can be exploited to trigger repeated memory allocations without proper cleanup.

Critical Impact

Remote attackers can exploit this vulnerability to render affected systems unresponsive by exhausting available memory, potentially causing complete system unavailability without requiring any authentication or user interaction.

Affected Products

• Linux Kernel versions 5.13 through 5.16.x
• Linux Kernel 5.17 release candidates (rc1 through rc6)
• NetApp A400, AFF 8300, AFF 8700 storage systems and firmware
• NetApp FAS 8300, FAS 8700 storage systems and firmware
• NetApp H-Series (H300E, H300S, H410C, H410S, H500E, H500S, H700E, H700S) systems and firmware

Discovery Timeline

• 2022-03-18 - CVE-2022-0742 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0742

Vulnerability Analysis

This vulnerability stems from improper memory management in the Linux kernel's ICMPv6 subsystem. When processing certain ICMPv6 multicast-related messages (specifically type 130 - Multicast Listener Query and type 131 - Multicast Listener Report), the kernel fails to properly release allocated memory buffers. Each malicious packet received triggers a memory allocation that is never freed, resulting in a cumulative memory leak.

The vulnerability is particularly dangerous because it can be exploited remotely over IPv6 networks without requiring authentication. An attacker simply needs network connectivity to the target system and the ability to send ICMPv6 packets. The attack surface is significant given the widespread deployment of IPv6 in modern networks.

The weakness is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-275 (Permission Issues), indicating fundamental issues with resource lifecycle management in the affected code path.

Root Cause

The root cause of CVE-2022-0742 lies in the igmp6.c file within the Linux kernel's IPv6 networking stack. The code path handling ICMPv6 multicast listener discovery messages allocates socket buffer (skb) structures to process incoming packets but fails to properly decrement reference counts or free these buffers under certain conditions. This results in memory being orphaned and never reclaimed by the kernel's memory management subsystem.

The fix, implemented in commit 2d3916f3189172d5c69d33065c3c21119fe539fc, ensures proper reference counting and memory cleanup for ICMPv6 multicast-related packet processing.

Attack Vector

The attack vector for CVE-2022-0742 is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target system running a vulnerable Linux kernel version (5.13+)
2. Sending a high volume of ICMPv6 type 130 or 131 packets to the target
3. Each packet triggers memory allocation without corresponding deallocation
4. The target system's available memory gradually depletes
5. Eventually, the system becomes unresponsive or crashes due to out-of-memory (OOM) conditions

The exploitation mechanism involves flooding the target with malformed or excessive ICMPv6 multicast listener discovery packets. Since these are standard network protocol messages, they may bypass basic firewall rules that allow ICMPv6 traffic for legitimate purposes such as neighbor discovery and path MTU detection.

Detection Methods for CVE-2022-0742

Indicators of Compromise

• Abnormal memory consumption growth over time without corresponding workload increases
• High volume of incoming ICMPv6 type 130 (Multicast Listener Query) packets from external sources
• High volume of incoming ICMPv6 type 131 (Multicast Listener Report) packets
• System logs indicating OOM (Out of Memory) killer activation
• Kernel slab allocator showing increasing memory usage in network-related caches

Detection Strategies

• Monitor system memory utilization trends using tools like vmstat, free, or /proc/meminfo
• Deploy network intrusion detection rules to alert on anomalous ICMPv6 traffic patterns
• Implement kernel memory monitoring to track sk_buff allocations in the networking subsystem
• Use netstat or ss to monitor IPv6 multicast group memberships for unusual activity

Monitoring Recommendations

• Configure alerts for sustained memory consumption above baseline thresholds
• Monitor network traffic for unusual spikes in ICMPv6 packets, particularly types 130 and 131
• Enable kernel memory leak detection tools such as kmemleak on non-production systems
• Review system logs regularly for OOM killer events and memory pressure warnings

How to Mitigate CVE-2022-0742

Immediate Actions Required

• Update affected Linux systems to kernel versions containing the fix (5.17-rc7 or later stable releases)
• Apply vendor-specific patches from NetApp for affected storage systems
• Implement rate limiting for ICMPv6 traffic at network perimeter devices
• Consider temporarily blocking ICMPv6 types 130 and 131 from untrusted sources if operationally feasible

Patch Information

The vulnerability is addressed in Linux kernel commit 2d3916f3189172d5c69d33065c3c21119fe539fc. Organizations should upgrade to patched kernel versions as recommended by the Linux Kernel Commit Update. For NetApp appliances, refer to the NetApp Security Advisory for specific firmware update guidance.

Workarounds

• Apply firewall rules to restrict ICMPv6 type 130 and 131 packets from untrusted networks
• Implement network-level rate limiting for ICMPv6 traffic to reduce attack impact
• Monitor and alert on memory consumption anomalies to enable rapid incident response
• Consider disabling IPv6 multicast listener discovery on systems where it is not required

# Example: Rate limit ICMPv6 type 130/131 using ip6tables
ip6tables -A INPUT -p icmpv6 --icmpv6-type 130 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 130 -j DROP
ip6tables -A INPUT -p icmpv6 --icmpv6-type 131 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 131 -j DROP