CVE-2022-21385: Oracle Linux Kernel DoS Vulnerability

CVE-2022-21385 Overview

CVE-2022-21385 is a kernel-level denial-of-service flaw affecting Oracle Linux. The vulnerability resides in the net_rds_alloc_sgs() function within the Reliable Datagram Sockets (RDS) networking subsystem. An unprivileged local user can trigger the flaw to crash the affected machine, resulting in a full system outage. The issue affects availability only — confidentiality and integrity are not impacted. Oracle addressed the flaw in upstream Linux kernel commit ea010070d0a7497253d5a6f919f6dd107450b31a.

Critical Impact
Any local, unprivileged user can trigger a kernel crash in Oracle Linux through the RDS socket subsystem, producing a full denial-of-service condition on the host.

Affected Products

Oracle Linux (kernels containing the vulnerable net_rds_alloc_sgs() implementation)
Linux kernel builds prior to upstream commit ea010070d0a7497253d5a6f919f6dd107450b31a
Systems with the rds kernel module loaded and accessible to local users

Discovery Timeline

2022-08-29 - CVE-2022-21385 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21385

Vulnerability Analysis

The flaw resides in net_rds_alloc_sgs(), a helper function used by the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. RDS provides reliable, in-order datagram delivery and is exposed through the AF_RDS socket family. When an unprivileged process invokes RDS operations that exercise the scatter-gather list allocation path, the function fails to handle a specific edge case safely. The result is a kernel-side fault that terminates execution of the running kernel context and crashes the host.

The vulnerability requires only local access. No authentication, elevated privileges, or user interaction are needed to reach the vulnerable code path. Exploitation produces a system-wide outage rather than code execution or data disclosure.

Root Cause

The root cause is improper validation inside net_rds_alloc_sgs() when allocating scatter-gather entries for RDS message buffers. The upstream fix in commit ea010070d0a7497253d5a6f919f6dd107450b31a corrects the allocation logic so that hostile or malformed input from userspace no longer drives the kernel into an unrecoverable state. NVD categorizes this issue under [NVD-CWE-noinfo] because detailed weakness classification was not provided at publication.

Attack Vector

The attack vector is local. An attacker with shell access — including low-privileged service accounts, sandboxed processes, or container workloads sharing the host kernel — opens an AF_RDS socket and issues operations that route execution through net_rds_alloc_sgs(). The crash occurs in kernel context, taking down the entire machine and any workloads running on it. Multi-tenant hosts and shared compute infrastructure face the highest operational risk.

No public proof-of-concept code is listed in the references, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities catalog. Technical specifics of the trigger condition are available in the upstream Linux Kernel Commit Update.

Detection Methods for CVE-2022-21385

Indicators of Compromise

Unexpected kernel panics or oops messages referencing net_rds_alloc_sgs or the rds module in /var/log/messages, dmesg, or journalctl -k output.
Sudden host reboots on Oracle Linux systems without a corresponding administrative action or hardware fault.
Local processes loading or interacting with the rds kernel module outside of expected application workloads.

Detection Strategies

Audit kernel module load events for rds and rds_tcp using auditd rules on init_module and finit_module syscalls.
Monitor for socket() calls using the AF_RDS family (address family 21) from processes that do not legitimately require RDS.
Correlate kernel crash telemetry with preceding local process activity to identify the triggering user and binary.

Monitoring Recommendations

Forward kernel ring-buffer logs and crash dumps to a centralized logging platform for retention and correlation.
Track uptime deltas across the Oracle Linux fleet to surface hosts experiencing unexplained reboots.
Alert on any non-administrative user space process that opens RDS sockets in production environments.

How to Mitigate CVE-2022-21385

Immediate Actions Required

Apply the Oracle Linux kernel update that incorporates upstream commit ea010070d0a7497253d5a6f919f6dd107450b31a to all affected hosts.
Inventory systems with the rds module present and prioritize patching multi-tenant, container, and shared-shell environments first.
Restrict local shell access on critical hosts until patching is complete to reduce the population of users able to trigger the flaw.

Patch Information

The authoritative fix is the upstream Linux kernel commit referenced by Oracle: Linux Kernel Commit Update. Install the latest Oracle Linux kernel package via yum update kernel or dnf update kernel and reboot to load the patched kernel. Verify the running kernel version matches the fixed build before returning the host to production.

Workarounds

Blacklist the rds module on hosts that do not require it by adding blacklist rds to /etc/modprobe.d/rds-blacklist.conf and rebuilding the initramfs.
Unload the module on running systems with modprobe -r rds after confirming no application depends on it.
Use seccomp or SELinux policy to deny the AF_RDS socket family for untrusted local users and container workloads.

bash

# Configuration example
# Disable the RDS kernel module on Oracle Linux
echo "blacklist rds" | sudo tee /etc/modprobe.d/rds-blacklist.conf
echo "install rds /bin/true" | sudo tee -a /etc/modprobe.d/rds-blacklist.conf

# Unload the module from a running kernel
sudo modprobe -r rds_tcp rds

# Apply the kernel patch by updating to the fixed Oracle Linux build
sudo dnf update kernel
sudo reboot

# Verify the running kernel after reboot
uname -r