Loading vulnerability…
Linux Kernel cgroups v1 release_agent Privilege Escalation
CVE-2022-0492 is an authorization vulnerability in the Linux kernel's cgroup_release_agent_write function. Under certain circumstances, insufficient authorization enforcement permits abuse of the cgroups v1 release_agent feature to escalate privileges and bypass Linux namespace isolation. In susceptible container configurations, the flaw can enable container escape. Exploitability depends on access to the affected functionality and the security controls enforced by the host.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can elevate an attacker's privileges and breach namespace isolation, potentially compromising the container host. Depending on the affected product and resulting privileges, consequences include sensitive-information disclosure, unauthorized data modification, and denial of service. OpenShift Container Platform nodes with their default SELinux policy enabled are protected against the described container-escape and privilege-escalation path.
If you can’t patch tonight, do this now.
Keep SELinux policy enabled on OpenShift cluster nodes to block the described exploitation path. For affected F5 BIG-IP and BIG-IQ systems, restrict SSH and management access to trusted users and networks, block unnecessary SSH access through self IP addresses and the management interface, and apply packet filtering. Remove management access for users who are not fully trusted. Follow product-specific vendor mitigations; discontinue affected products if effective mitigations or fixes are unavailable.
Patch, then assume compromise.
Install the vendor-supported kernel or product update that fixes CVE-2022-0492. Fedora included the fix in kernel 5.16.6; distribution kernels may instead contain backported fixes. Examples include RHEL 8 kernel 4.18.0-348.20.1.el8_5 under RHSA-2022:0825 and RHEL 8.4 EUS kernel 4.18.0-305.45.1.el8_4 under RHSA-2022:1455. Reboot after a conventional kernel update, or deploy an applicable vendor-supported live patch and verify that it is active. For affected F5 products, upgrade to a fixed release or a supported branch containing the fix. Update affected Siemens RUGGEDCOM ROX products to V2.17.0 or later.
4 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.