CVE-2022-28356: Linux Kernel Refcount Leak Vulnerability

CVE-2022-28356 Overview

CVE-2022-28356 is a refcount leak vulnerability in the Linux kernel's Logical Link Control (LLC) socket implementation. The flaw resides in net/llc/af_llc.c and affects Linux kernel versions before 5.17.1. A local attacker with low privileges can trigger the netdevice reference leak through repeated llc_ui_bind() operations, eventually exhausting kernel resources. The vulnerability impacts availability and can lead to denial of service on affected systems. Debian distributions versions 9.0, 10.0, and 11.0 are also impacted and addressed by upstream security advisories.

Critical Impact
Local attackers can exhaust kernel netdevice references through repeated LLC socket bind operations, resulting in resource exhaustion and denial of service.

Affected Products

Linux Kernel versions before 5.17.1
Debian Linux 9.0, 10.0, and 11.0
NetApp products referenced in advisory NTAP-20220506-0006

Discovery Timeline

2022-04-02 - CVE-2022-28356 published to the National Vulnerability Database
2022-04-06 - Public discussion on the Openwall oss-security mailing list
2022-05-06 - NetApp publishes security advisory NTAP-20220506-0006
2022-07 - Debian LTS announcement published addressing affected packages
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2022-28356

Vulnerability Analysis

The vulnerability is a netdevice reference count leak inside the LLC socket binding logic. When llc_ui_bind() is invoked, the kernel acquires a reference on the associated network device via dev_hold_track(). If the function later encounters an error path after successful device acquisition, the corresponding reference is not released. Repeated invocations of the vulnerable code path increment the device refcount without a matching decrement.

This class of issue falls under resource exhaustion and memory leak categories. Because the leaked reference is on a kernel net_device structure, the device cannot be properly unregistered or freed. The result is kernel state corruption and potential denial of service through resource starvation.

Root Cause

The root cause is missing cleanup logic in the error handling path of llc_ui_bind() in net/llc/af_llc.c. The function failed to release the netdevice reference and reset llc->dev to NULL when binding operations failed after the device was acquired. This omission allows the reference count to grow unbounded across repeated failed bind calls.

Attack Vector

Exploitation requires local access with low privileges. An attacker creates an LLC socket and repeatedly invokes the bind() system call with parameters that trigger failure after the device reference is taken. Each iteration leaks one netdevice reference, progressively degrading kernel state until the attacker achieves denial of service against the target system.

// Linux kernel patch: net/llc/af_llc.c
// llc: fix netdevice reference leaks in llc_ui_bind()

	sock_reset_flag(sk, SOCK_ZAPPED);
	rc = 0;
out:
+	if (rc) {
+		dev_put_track(llc->dev, &llc->dev_tracker);
+		llc->dev = NULL;
+	}
	return rc;
}

Source: GitHub Linux Commit 764f4eb. The patch adds an error-path cleanup block that calls dev_put_track() to release the netdevice reference and nullifies llc->dev when rc is non-zero.

Detection Methods for CVE-2022-28356

Indicators of Compromise

Unexpected growth in kernel net_device reference counts visible through /proc/net/dev and kernel debug interfaces
Repeated failures from local processes invoking bind() on AF_LLC sockets
Kernel log entries indicating delayed or stuck network device unregistration
Gradual degradation of network subsystem responsiveness without corresponding traffic load

Detection Strategies

Audit running kernel versions across the fleet and flag any host running Linux kernel earlier than 5.17.1
Monitor for processes making high-frequency socket(AF_LLC, ...) and bind() syscalls using auditd or eBPF probes
Track kernel slab and netdevice statistics over time to detect abnormal growth patterns
Correlate local user activity with kernel resource consumption metrics to identify abuse patterns

Monitoring Recommendations

Enable syscall auditing for socket and bind operations targeting the AF_LLC family
Forward kernel logs and dmesg output to a centralized logging platform for analysis
Establish baselines for netdevice reference counts and alert on unexpected deviations
Restrict and log unprivileged user activity on multi-tenant Linux hosts

How to Mitigate CVE-2022-28356

Immediate Actions Required

Update the Linux kernel to version 5.17.1 or later on all affected systems
Apply distribution-specific updates referenced in Debian advisories DSA-5127 and DSA-5173
Review NetApp advisory NTAP-20220506-0006 for vendor-specific guidance on affected appliances
Restrict local shell access on multi-user systems until patches are applied

Patch Information

The upstream fix is recorded in commit 764f4eb6846f5475f1244767d24d25dd86528a4a and shipped in the Linux Kernel ChangeLog 5.17.1. Debian users should consult Debian Security Advisory DSA-5127 and Debian Security Advisory DSA-5173. Additional vendor guidance is available in the NetApp Security Advisory NTAP-20220506-0006 and the Debian LTS Announcement July 2022.

Workarounds

Blacklist the llc kernel module on systems that do not require LLC protocol support using /etc/modprobe.d/ configuration
Restrict the AF_LLC socket family through seccomp profiles for untrusted workloads and containers
Limit local user account creation and enforce least privilege until patched kernels are deployed

bash

# Blacklist the LLC module on systems that do not need it
echo "blacklist llc" | sudo tee /etc/modprobe.d/blacklist-llc.conf
echo "blacklist llc2" | sudo tee -a /etc/modprobe.d/blacklist-llc.conf
sudo update-initramfs -u

# Verify the running kernel version after patching
uname -r