privilege-escalation-methodwidely-deployed-product-advisoryendpoint-software-vulnerabilitycloud-service-vulnerability

Red Hat RHEL 8.4 Kernel Update Fixes Netfilter Root Escalation and Six CVEs

Attack Tradecraft · 11 sources · Updated 2mo ago · First seen Jul 27, 2022

Red Hat released RHSA-2022:5626 for Red Hat Enterprise Linux 8.4 Extended Update Support, delivering kernel 4.18.0-305.57.1.el8_4 for x86_64, s390x, ppc64le, and aarch64. The update remediates six kernel vulnerabilities, including CVE-2022-32250, a netfilter use-after-free write that can enable local root escalation, and CVE-2022-1729, affecting perf_event_open. It also addresses cgroup migration permission handling in CVE-2021-4197, which can let a less-privileged process induce a privileged process to write through an attacker-created file descriptor, and CVE-2021-4203, a socket credential race that can crash the system or disclose kernel information.

Red Hat also issued RHBA-2022:5744 to update Red Hat OpenStack Platform 16.2 container images, incorporating the kernel security fixes for x86_64 and IBM Power ppc64le deployments. Organizations should install the applicable RHEL kernel update and reboot hosts for remediation to take effect; OpenStack Platform users should upgrade the supplied container images and rebuild dependent images.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

11 events · Nov 9, 2021 – Aug 2, 2022

Aug 2, 20224y ago
Red Hat releases RHEL 8.6 kernel-rt fixes for CVE-2022-32250
Red Hat issued Important advisory RHSA-2022:5834 for RHEL 8 Real Time kernel packages, providing kernel-rt 4.18.0-372.19.1.rt7.176.el8_6. The update remediated CVE-2022-32250 and the TCP source-port information-disclosure flaw CVE-2022-1012; affected systems require a reboot.
RHSA-2022:5834 - Security Advisory - Red Hat Customer Portal
Jul 27, 20224y ago
Red Hat updates OpenStack 16.2 container images
Red Hat issued RHBA-2022:5744 to update Red Hat OpenStack Platform 16.2 container images for x86_64 and ppc64le with backported fixes for the RHSA-2022:5626 security issues. Users were advised to upgrade the images and rebuild dependent container images.
RHBA-2022:5744 - Bug Fix Advisory - Red Hat Customer Portal
Jul 19, 20224y ago
Red Hat releases RHEL 8.4 EUS Real Time kernel security update
Red Hat issued Important advisory RHSA-2022:5633 for kernel-rt packages in RHEL 8.4 Extended Update Support Real Time and telecommunications/NFV offerings. Kernel-rt 4.18.0-305.57.1.rt7.129.el8_4 remediated CVE-2021-4197 and CVE-2021-4203 plus four other kernel vulnerabilities; affected systems require a reboot.
RHSA-2022:5633 - Security Advisory - Red Hat Customer Portal
Jul 19, 20224y ago
Red Hat releases RHEL 8.4 EUS kernel security update
Red Hat issued Important advisory RHSA-2022:5626 for RHEL 8.4 Extended Update Support, delivering kernel version 4.18.0-305.57.1.el8_4. The update remediated CVE-2021-4197 and CVE-2021-4203 along with four other kernel vulnerabilities; affected systems require a reboot after installation.
RHSA-2022:5626 - Security Advisory - Red Hat Customer Portal
Reported Jun 28, 20224y ago
Red Hat releases extended-support RHEL 7 fixes for CVE-2022-32250
Red Hat issued CVE-2022-32250 fixes for RHEL 7.3, 7.4, and 7.6 Advanced Update Support kernel packages. It also released RHSA-2022:5802 for RHEL 7.6 Telco EUS and SAP Solutions kernels and RHSA-2022:5804 for SAP Solutions kpatch-patch packages.
CVE-2022-32250 - Red Hat Customer Portal
Jun 28, 20224y ago
Red Hat releases RHEL 7 fixes for CVE-2022-32250
Red Hat issued RHSA-2022:5232 for the RHEL 7 kernel, RHSA-2022:5236 for kernel-rt, and RHSA-2022:5216 for kpatch-patch to remediate the CVE-2022-32250 Netfilter use-after-free vulnerability.
CVE-2022-32250 - Red Hat Customer Portal
May 25, 20224y ago
Upstream fixes CVE-2022-32250 netfilter use-after-free flaw
Pablo Neira Ayuso authored and signed off on upstream commit 520778042ccca019f3ffa136dd0ca565c486cedd, which fixes CVE-2022-32250 by validating NFT_STATEFUL_EXPR before expression initialization. The flaw is a netfilter nf_tables use-after-free write that can enable local privilege escalation to root when user and network namespaces can be created.
2092427 - (CVE-2022-32250) CVE-2022-32250 kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root
May 11, 20224y ago
Red Hat closes tracking bugs for CVE-2021-4197 and CVE-2021-4203
Red Hat closed its tracking bugs for the cgroup migration permission-check flaw and the socket credential race condition.
2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checks
Jan 4, 20225y ago
CVE-2021-4203 reported by Pedro Sampaio
Pedro Sampaio reported a Linux kernel sock_getsockopt() use-after-free read caused by races in SO_PEERCRED and SO_PEERGROUPS handling with listen() or connect(). A local user could crash a system or disclose internal kernel information.
2036934 - (CVE-2021-4203) CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses
Dec 26, 20215y ago
CVE-2021-4197 reported to Red Hat
A vulnerability in Linux kernel cgroup migration permission checks was reported. The flaw could allow a less-privileged process to induce a more-privileged process to write to a file descriptor it created, potentially enabling local privilege escalation.
2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checks
Nov 9, 20215y ago
Red Hat releases RHEL 8 fixes for CVE-2020-29368
Red Hat released RHSA-2021:4356 for RHEL 8 kernel packages and RHSA-2021:4140 for RHEL 8 kernel-rt packages to remediate CVE-2020-29368, a transparent huge page copy-on-write mapcount race condition that can grant unintended write access.
CVE-2020-29368 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

8 linked

Linux Kernel Open vSwitch Nested Actions Memory Leak (CVE-2022-49086)Use-after-free read in Linux kernel socket peer credential handling (CVE-2021-4203)Local Privilege Escalation in Linux Kernel cgroup Migration Permission Checks (CVE-2021-4197)Linux Kernel THP Copy-on-Write Race Condition (CVE-2020-29368)Linux Kernel TCP Source-Port Generation Information Disclosure (CVE-2022-1012)Linux Kernel perf_event_open Race Condition Leading to Root Privilege Escalation (CVE-2022-1729)Linux kernel device-mapper I/O completion race NULL-pointer dereference (CVE-2021-47435)Linux Netfilter nf_tables Use-After-Free Privilege Escalation (CVE-2022-32250)

Affected products

2 linked

Linux KernelRed Hat Enterprise Linux

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

11 references tracked. Mallory keeps watching after this page renders.

CveAdvisories · Jan 1, 2026

CVE Record: CVE-2022-32250Open source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5834 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5626 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5633 - Security Advisory - Red Hat Customer PortalOpen source ↗

3 additional sources from 28-06-2022 to 01-01-2026

Redhat OtherNews · Jun 28, 2022

CVE-2022-32250 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · May 12, 2022

2036934 - (CVE-2021-4203) CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred accessesOpen source ↗

Bugzilla RedhatNews · May 12, 2022

2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checksOpen source ↗

Redhat OtherNews · Nov 9, 2021

CVE-2020-29368 - Red Hat Customer PortalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

privilege-escalation-methodwidely-deployed-product-advisoryendpoint-software-vulnerabilitycloud-service-vulnerability

Red Hat RHEL 8.4 Kernel Update Fixes Netfilter Root Escalation and Six CVEs

Attack Tradecraft · 11 sources · Updated 2mo ago · First seen Jul 27, 2022

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

11 events · Nov 9, 2021 – Aug 2, 2022

Aug 2, 20224y ago
Red Hat releases RHEL 8.6 kernel-rt fixes for CVE-2022-32250
Red Hat issued Important advisory RHSA-2022:5834 for RHEL 8 Real Time kernel packages, providing kernel-rt 4.18.0-372.19.1.rt7.176.el8_6. The update remediated CVE-2022-32250 and the TCP source-port information-disclosure flaw CVE-2022-1012; affected systems require a reboot.
RHSA-2022:5834 - Security Advisory - Red Hat Customer Portal
Jul 27, 20224y ago
Red Hat updates OpenStack 16.2 container images
Red Hat issued RHBA-2022:5744 to update Red Hat OpenStack Platform 16.2 container images for x86_64 and ppc64le with backported fixes for the RHSA-2022:5626 security issues. Users were advised to upgrade the images and rebuild dependent container images.
RHBA-2022:5744 - Bug Fix Advisory - Red Hat Customer Portal
Jul 19, 20224y ago
Red Hat releases RHEL 8.4 EUS Real Time kernel security update
Red Hat issued Important advisory RHSA-2022:5633 for kernel-rt packages in RHEL 8.4 Extended Update Support Real Time and telecommunications/NFV offerings. Kernel-rt 4.18.0-305.57.1.rt7.129.el8_4 remediated CVE-2021-4197 and CVE-2021-4203 plus four other kernel vulnerabilities; affected systems require a reboot.
RHSA-2022:5633 - Security Advisory - Red Hat Customer Portal
Jul 19, 20224y ago
Red Hat releases RHEL 8.4 EUS kernel security update
Red Hat issued Important advisory RHSA-2022:5626 for RHEL 8.4 Extended Update Support, delivering kernel version 4.18.0-305.57.1.el8_4. The update remediated CVE-2021-4197 and CVE-2021-4203 along with four other kernel vulnerabilities; affected systems require a reboot after installation.
RHSA-2022:5626 - Security Advisory - Red Hat Customer Portal
Reported Jun 28, 20224y ago
Red Hat releases extended-support RHEL 7 fixes for CVE-2022-32250
Red Hat issued CVE-2022-32250 fixes for RHEL 7.3, 7.4, and 7.6 Advanced Update Support kernel packages. It also released RHSA-2022:5802 for RHEL 7.6 Telco EUS and SAP Solutions kernels and RHSA-2022:5804 for SAP Solutions kpatch-patch packages.
CVE-2022-32250 - Red Hat Customer Portal
Jun 28, 20224y ago
Red Hat releases RHEL 7 fixes for CVE-2022-32250
Red Hat issued RHSA-2022:5232 for the RHEL 7 kernel, RHSA-2022:5236 for kernel-rt, and RHSA-2022:5216 for kpatch-patch to remediate the CVE-2022-32250 Netfilter use-after-free vulnerability.
CVE-2022-32250 - Red Hat Customer Portal
May 25, 20224y ago
Upstream fixes CVE-2022-32250 netfilter use-after-free flaw
Pablo Neira Ayuso authored and signed off on upstream commit 520778042ccca019f3ffa136dd0ca565c486cedd, which fixes CVE-2022-32250 by validating NFT_STATEFUL_EXPR before expression initialization. The flaw is a netfilter nf_tables use-after-free write that can enable local privilege escalation to root when user and network namespaces can be created.
2092427 - (CVE-2022-32250) CVE-2022-32250 kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root
May 11, 20224y ago
Red Hat closes tracking bugs for CVE-2021-4197 and CVE-2021-4203
Red Hat closed its tracking bugs for the cgroup migration permission-check flaw and the socket credential race condition.
2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checks
Jan 4, 20225y ago
CVE-2021-4203 reported by Pedro Sampaio
Pedro Sampaio reported a Linux kernel sock_getsockopt() use-after-free read caused by races in SO_PEERCRED and SO_PEERGROUPS handling with listen() or connect(). A local user could crash a system or disclose internal kernel information.
2036934 - (CVE-2021-4203) CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses
Dec 26, 20215y ago
CVE-2021-4197 reported to Red Hat
A vulnerability in Linux kernel cgroup migration permission checks was reported. The flaw could allow a less-privileged process to induce a more-privileged process to write to a file descriptor it created, potentially enabling local privilege escalation.
2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checks
Nov 9, 20215y ago
Red Hat releases RHEL 8 fixes for CVE-2020-29368
Red Hat released RHSA-2021:4356 for RHEL 8 kernel packages and RHSA-2021:4140 for RHEL 8 kernel-rt packages to remediate CVE-2020-29368, a transparent huge page copy-on-write mapcount race condition that can grant unintended write access.
CVE-2020-29368 - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

8 linked

Affected products

2 linked

Linux KernelRed Hat Enterprise Linux

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

11 references tracked. Mallory keeps watching after this page renders.

CveAdvisories · Jan 1, 2026

CVE Record: CVE-2022-32250Open source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5834 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5626 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2022:5633 - Security Advisory - Red Hat Customer PortalOpen source ↗

3 additional sources from 28-06-2022 to 01-01-2026

Redhat OtherNews · Jun 28, 2022

CVE-2022-32250 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · May 12, 2022

2036934 - (CVE-2021-4203) CVE-2021-4203 kernel: Race condition in races in sk_peer_pid and sk_peer_cred accessesOpen source ↗

Bugzilla RedhatNews · May 12, 2022

2035652 - (CVE-2021-4197) CVE-2021-4197 kernel: cgroup: Use open-time creds and namespace for migration perm checksOpen source ↗

Redhat OtherNews · Nov 9, 2021

CVE-2020-29368 - Red Hat Customer PortalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Red Hat RHEL 8.4 Kernel Update Fixes Netfilter Root Escalation and Six CVEs

How this story unfolded

Red Hat releases RHEL 8.6 kernel-rt fixes for CVE-2022-32250

Red Hat updates OpenStack 16.2 container images

Red Hat releases RHEL 8.4 EUS Real Time kernel security update

Red Hat releases RHEL 8.4 EUS kernel security update

Red Hat releases extended-support RHEL 7 fixes for CVE-2022-32250

Red Hat releases RHEL 7 fixes for CVE-2022-32250

Upstream fixes CVE-2022-32250 netfilter use-after-free flaw

Red Hat closes tracking bugs for CVE-2021-4197 and CVE-2021-4203

CVE-2021-4203 reported by Pedro Sampaio

CVE-2021-4197 reported to Red Hat

Red Hat releases RHEL 8 fixes for CVE-2020-29368

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat Kernel Updates Remediate RCE, Use-After-Free and Network Flaws

Red Hat Kernel Updates Fix Netfilter Root Escalation and TCP Information Leak

Red Hat Kernel Updates Fix cgroups v1 Container-Escape Privilege Escalation

Red Hat RHEL 8.4 Kernel Update Fixes Netfilter Root Escalation and Six CVEs

How this story unfolded

Red Hat releases RHEL 8.6 kernel-rt fixes for CVE-2022-32250

Red Hat updates OpenStack 16.2 container images

Red Hat releases RHEL 8.4 EUS Real Time kernel security update

Red Hat releases RHEL 8.4 EUS kernel security update

Red Hat releases extended-support RHEL 7 fixes for CVE-2022-32250

Red Hat releases RHEL 7 fixes for CVE-2022-32250

Upstream fixes CVE-2022-32250 netfilter use-after-free flaw

Red Hat closes tracking bugs for CVE-2021-4197 and CVE-2021-4203

CVE-2021-4203 reported by Pedro Sampaio

CVE-2021-4197 reported to Red Hat

Red Hat releases RHEL 8 fixes for CVE-2020-29368

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat Kernel Updates Remediate RCE, Use-After-Free and Network Flaws

Red Hat Kernel Updates Fix Netfilter Root Escalation and TCP Information Leak

Red Hat Kernel Updates Fix cgroups v1 Container-Escape Privilege Escalation