Google addresses actively exploited Android flaw in the kernel

CVE-2021-22600 is a double-free flaw (CWE-415) in packet_set_ring() in the Linux kernel's net/packet/af_packet.c, the code that manages packet socket ring buffers. A local, low-privileged user can trigger it through crafted syscalls on AF_PACKET sockets, causing kernel memory corruption. A successful attacker gains local privilege escalation to kernel/root-level control, or can instead crash the system in a denial of service; the flaw scores 7.0 (High) with a local attack vector and high attack complexity. Any kernel built before the fix commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 is affected, spanning the upstream Linux kernel, Debian Linux, Google's Android (patched in an actively exploited April 2022 Android security update), and NetApp storage products that embed the Linux kernel (8300, 8700, A400, C400, and H-series firmware). The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 and Google patched it as actively exploited, so it is being exploited in the wild, though no standalone public PoC is known and any ransomware use is unconfirmed.

Do: Upgrade the Linux kernel to a release past the affected versions, or rebuild from source including commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755; apply Debian security updates and NetApp firmware updates per each vendor's advisory. Because the flaw is in CISA's KEV catalog and Google confirmed active exploitation, prioritize patching for hosts that grant interactive/local access to untrusted users. If patching must be delayed, restrict local logins and monitor for suspicious AF_PACKET ring-buffer syscall activity and unexplained crashes or reboots.