CVE-2022-36946: Linux Kernel DoS Vulnerability

CVE-2022-36946 Overview

CVE-2022-36946 is a denial of service vulnerability in the Linux kernel's netfilter subsystem. The flaw exists in the nfqnl_mangle function within net/netfilter/nfnetlink_queue.c, where improper handling of nf_queue verdicts with a one-byte nfta_payload attribute can cause skb_pull to encounter a negative skb->len value. This condition triggers a kernel panic, allowing remote attackers to crash affected systems.

Critical Impact

Remote attackers can cause a complete system denial of service by triggering a kernel panic through specially crafted network packets, affecting availability of Linux-based systems and infrastructure.

Affected Products

• Linux Kernel through version 5.18.14
• Debian Linux 10.0 and 11.0
• NetApp Active IQ Unified Manager for VMware vSphere
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire & HCI Storage Node
• NetApp SolidFire Enterprise SDS
• NetApp HCI Compute Node

Discovery Timeline

• 2022-07-27 - CVE-2022-36946 published to NVD
• 2025-05-05 - Last updated in NVD database

Technical Details for CVE-2022-36946

Vulnerability Analysis

This denial of service vulnerability occurs in the netfilter queue handling code of the Linux kernel. The nfqnl_mangle function is responsible for modifying packet data when processing nf_queue verdicts. Under specific conditions, when a verdict includes an nfta_payload attribute with a length of only one byte, the function's buffer manipulation logic fails to properly validate the resulting buffer length.

The vulnerability enables remote attackers to trigger a kernel panic without requiring authentication or user interaction. Systems using netfilter packet queuing functionality (such as those running intrusion detection systems, firewalls, or custom packet processing applications that leverage NFQUEUE) are particularly susceptible. When exploited, the kernel encounters an assertion failure due to the negative length condition, resulting in an immediate system crash.

Root Cause

The root cause lies in insufficient validation within the nfqnl_mangle function when processing packet modification requests. The function calls skb_pull to remove data from the beginning of a socket buffer (skb), but fails to properly check that the resulting skb->len would remain non-negative. When an nf_queue verdict specifies an nfta_payload attribute with minimal data (one byte), the calculation can result in a negative length value, violating kernel invariants and triggering a panic.

Attack Vector

The attack can be executed remotely over the network without requiring any privileges or user interaction. An attacker needs to craft malicious network packets that, when processed by the kernel's netfilter queue mechanism, trigger the vulnerable code path. The attack targets systems where:

1. The netfilter NFQUEUE target is in use (common in IDS/IPS deployments)
2. Userspace applications are processing queued packets via libnetfilter_queue
3. The vulnerable code path is reachable through packet processing rules

The exploitation results in an immediate kernel panic, causing a complete denial of service that requires system reboot to recover. No data confidentiality or integrity impact has been identified; the vulnerability is limited to availability disruption.

Detection Methods for CVE-2022-36946

Indicators of Compromise

• Unexpected kernel panics with backtraces referencing nfqnl_mangle or nfnetlink_queue.c
• System crashes coinciding with high volumes of unusual network traffic patterns
• Kernel log entries showing negative skb->len assertions or related netfilter errors
• Repeated system reboots without apparent cause on systems running NFQUEUE-based applications

Detection Strategies

• Monitor kernel logs for panic messages containing nfqnl_mangle, nfnetlink_queue, or skb_pull references
• Implement network traffic analysis to detect anomalous packets targeting NFQUEUE processing
• Deploy kernel crash dump analysis tools to identify exploitation attempts post-crash
• Use runtime kernel integrity monitoring to detect attempted exploitation

Monitoring Recommendations

• Enable kernel crash dump collection (kdump) to capture diagnostic information during panics
• Configure centralized logging to preserve kernel messages before system crashes
• Monitor system uptime and unplanned reboot events across infrastructure
• Track netfilter queue statistics for unusual packet processing patterns

How to Mitigate CVE-2022-36946

Immediate Actions Required

• Update Linux kernel to a patched version that includes commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164
• Review iptables/nftables rules and temporarily disable NFQUEUE targets if patching is not immediately possible
• Prioritize patching on systems running IDS/IPS or custom packet processing applications
• Apply vendor-specific patches for Debian, NetApp, and other affected distributions

Patch Information

The vulnerability has been addressed in the upstream Linux kernel. The fix is available in commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164. Distribution-specific patches are available:

• Debian: Security advisory DSA-5207 provides patched packages. Additional updates available via Debian LTS announcements.
• NetApp: Refer to security advisory NTAP-20220901-0007 for affected products and remediation guidance.

Workarounds

• Remove or disable NFQUEUE targets from iptables/nftables rules until patching is complete
• Implement network segmentation to limit exposure of vulnerable systems to untrusted traffic
• Deploy network-level filtering to drop malformed packets before they reach vulnerable hosts
• Consider using alternative packet processing mechanisms that do not rely on NFQUEUE

# Temporary workaround: Remove NFQUEUE rules
# List current NFQUEUE rules
iptables -L -n -v | grep NFQUEUE
ip6tables -L -n -v | grep NFQUEUE

# Remove specific NFQUEUE rules (adjust chain and rule numbers as needed)
# iptables -D INPUT <rule_number>
# iptables -D FORWARD <rule_number>

# Verify kernel version and check if patch is applied
uname -r
# Patched kernels include commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164