Loading vulnerability…
CVE-2022-0492 is an improper authentication vulnerability in the Linux kernel cgroups v1 subsystem, specifically in the cgroup_release_agent_write function in kernel/cgroup/cgroup-v1.c. The flaw results from insufficient privilege validation when writing to the release_agent mechanism. Under certain circumstances, a local attacker can abuse the cgroups v1 release_agent feature to bypass namespace isolation and escalate privileges. In containerized environments, this can be used as a container escape primitive: an attacker with root inside a container can mount a cgroups v1 controller, configure notify_on_release and release_agent, and cause the host kernel to execute an attacker-controlled payload on the host when the cgroup becomes empty. The issue is particularly relevant to Linux systems and container platforms that still use cgroups v1 and permit the required namespace and mount operations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository provides a working exploit for CVE-2022-0492, a Linux kernel vulnerability in the cgroup release_agent mechanism that allows container escape. The exploit is implemented as a Bash script (exp.sh) that automates the process of mounting a cgroup subsystem, setting up a malicious release_agent, and triggering it to execute arbitrary commands on the host system. The README.md provides a detailed technical analysis of the vulnerability, exploitation prerequisites, and mitigation strategies. The exploit requires root privileges inside a vulnerable container and leverages the lack of proper security hardening (e.g., seccomp, apparmor, selinux) to escape to the host. The script creates several files and directories (such as /tmp/testcgroup, /cmd, and /result) and interacts with system files like /etc/mtab and /proc to determine the host path and capabilities. The repository is operational and can be used to achieve container escape on affected systems.
This repository provides a Bash script (CVE-2022-0492.sh) that serves as both a checker and a proof-of-concept exploit for CVE-2022-0492, a Linux kernel vulnerability affecting cgroups v1. The script can be run inside a Docker container to determine if the environment is vulnerable, and if so, to exploit the vulnerability and escape the container, executing arbitrary commands as root on the host. The exploit leverages the cgroup release_agent mechanism to run attacker-supplied code on the host. The script supports two main modes: a checker mode (to test for vulnerability) and a command mode (to execute arbitrary commands on the host). The README provides background on the vulnerability, usage instructions, and example payloads (such as reverse shells). The only code file is the Bash script; the other files are a README and a license. The exploit is operational and can be used to achieve full host compromise from a privileged container on a vulnerable system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
58 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel cgroups container escape vulnerability referenced as background for a related escape technique, not the main subject of the content.
A Linux kernel privilege escalation and container escape vulnerability involving the cgroups v1 release_agent feature, caused by insufficient validation and authentication controls, allowing local attackers to execute arbitrary commands with elevated privileges.
A Linux kernel cgroups v1 release_agent improper authentication / privilege escalation vulnerability that can allow container escape and execution of arbitrary commands on the host.
A Linux kernel improper authentication vulnerability in cgroups that can allow local attackers to escape containers and execute arbitrary commands on the host via privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.