Bugzilla – Bug 1197128
VUL-0: CVE-2022-0742: kernel: bug memory leaks in ICMPv6 handlers
Last modified: 2022-07-21 20:34:32 UTC
A flaw in the Linux Kernel found.
If looking at a suspect synchronize_net() added in the blamed commit
f185de28d9ae ("mld: add new workqueues for process mld events"),
I found that igmp6_event_query() and igmp6_event_report()
simply forget to free skbs when their respective queues are full.
The fix is for the
This means that attackers can remotely OOM hosts, which is not nice.
As far as I can see, recent commit 2d3916f31891 ("ipv6: fix skb drops in
igmp6_event_query() and igmp6_event_report()"), present in mainline 5.17-rc7
and stable 5.16.13, should address the issue as described in the initial
introduced f185de28d9ae v5.13-rc1
fixed 2d3916f31891 v5.17-rc7
The offending commit has not been backported into any pre-5.13 branch and
stable and master received the fix already so only SLE15-SP4 should need it.
From: "sirdarckcat ." <firstname.lastname@example.org>
Subject: [oss-security] CVE-2022-0742: Remote Denial of Service on Linux Kernel >=5.13 icmp6
Flooding icmp6 messages of type 130 or 131 is enough to exploit a
memory leak in the kernel and cause the host to go out-of-memory. The
volume of traffic doesn't need to be particularly high. Note that
since the vulnerability was introduced recently (5.13) only 5.15's
stable was affected.
This vulnerability was found/fixed by Eric Dumazet.
CVE will land on MITRE's website sometime this week.
This was fixed on https://kernel.dance/2d3916f3189172d5c69d33065c3c21119fe539fc
"the commit landed on upstream on": [
"the commit was backported to": [
"the commit fixes a bug introduced by": [
"fixes": "f185de28d9ae (\"mld: add new workqueues for process mld events\")"
"the buggy commit landed on upstream on": [
ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
While investigating on why a synchronize_net() has been added recently
in ipv6_mc_down(), I found that igmp6_event_query() and igmp6_event_report()
might drop skbs in some cases.
Discussion about removing synchronize_net() from ipv6_mc_down()
will happen in a different thread.
Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
Signed-off-by: Eric Dumazet <email@example.com>
Cc: Taehee Yoo <firstname.lastname@example.org>
Cc: Cong Wang <email@example.com>
Cc: David Ahern <firstname.lastname@example.org>
Signed-off-by: Jakub Kicinski <email@example.com>
Following https://about.google/appsecurity/ policy:
Feb 23, 2022 - Discovery / Shared with network upstream maintainers,
reproduced, patch confirmed to work, CVE reserved
Feb 25, 2022 - firstname.lastname@example.org decides fix/disclosure timeline
Mar 3, 2022 - Patch lands on mainline (Linus tree)
Mar 8, 2022 - Patch lands on stable (5.15/5.16)
Mar 15, 2022 - This email is sent (public disclosure of vuln details)
The fix has been submitted to
SLE15-SP4 86ba959dfd70 *
No other branch needs it.
Reassigning back to security team.
I wonder if this should rather go to SLE15-SP4-GA?
(In reply to Vlastimil Babka from comment #5)
> I wonder if this should rather go to SLE15-SP4-GA?
Michal resubmitted to GA, I merged.
yes, definitely should be fixed in GA