Loading vulnerability…
CVE-2022-0492 is an improper privilege-management vulnerability in the Linux kernel cgroup v1 release_agent handling, specifically cgroup_release_agent_write() in kernel/cgroup/cgroup-v1.c. The vulnerable permission check permits a process privileged through a non-initial user namespace to configure the cgroup v1 release_agent facility. Because release-agent programs are invoked by the host kernel with host-level privileges, this can allow code originating in a container or other nested namespace to execute outside its intended namespace boundary.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a single Metasploit module: 'Docker cgroups Container Escape' (modules/exploits/linux/local/docker_cgroup_escape.rb). The module exploits CVE-2022-0492, a vulnerability in the Linux kernel's cgroup v1 release_agent feature, to escape from a privileged Docker container to the host system with root privileges. The exploit requires a session as root inside the container and targets specific vulnerable kernel versions, primarily on Ubuntu systems. The module mounts a cgroup, manipulates the release_agent, and uploads a payload (either a Meterpreter reverse shell or a bash reverse shell) to the host filesystem, then triggers execution to gain code execution on the host. The code interacts with system files such as /etc/mtab and /tmp, and is designed for operational use within the Metasploit framework. The exploit is weaponized, allowing for customizable payloads and automated cleanup.
This repository provides a working exploit for CVE-2022-0492, a Linux kernel vulnerability in the cgroup release_agent mechanism that allows container escape. The exploit is implemented as a Bash script (exp.sh) that automates the process of mounting a cgroup subsystem, setting up a malicious release_agent, and triggering it to execute arbitrary commands on the host system. The README.md provides a detailed technical analysis of the vulnerability, exploitation prerequisites, and mitigation strategies. The exploit requires root privileges inside a vulnerable container and leverages the lack of proper security hardening (e.g., seccomp, apparmor, selinux) to escape to the host. The script creates several files and directories (such as /tmp/testcgroup, /cmd, and /result) and interacts with system files like /etc/mtab and /proc to determine the host path and capabilities. The repository is operational and can be used to achieve container escape on affected systems.
This repository provides a Bash script (CVE-2022-0492.sh) that serves as both a checker and a proof-of-concept exploit for CVE-2022-0492, a Linux kernel vulnerability affecting cgroups v1. The script can be run inside a Docker container to determine if the environment is vulnerable, and if so, to exploit the vulnerability and escape the container, executing arbitrary commands as root on the host. The exploit leverages the cgroup release_agent mechanism to run attacker-supplied code on the host. The script supports two main modes: a checker mode (to test for vulnerability) and a command mode (to execute arbitrary commands on the host). The README provides background on the vulnerability, usage instructions, and example payloads (such as reverse shells). The only code file is the Bash script; the other files are a README and a license. The exploit is operational and can be used to achieve full host compromise from a privileged container on a vulnerable system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
81 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel container escape vulnerability in the cgroup v1 release_agent feature that can allow command execution on the host from a container under certain privileged conditions, illustrating a concrete escape vector relevant to Kubernetes runtime security.
A Linux kernel cgroups container escape vulnerability referenced as background for a related escape technique, not the main subject of the content.
A Linux kernel privilege escalation and container escape vulnerability involving the cgroups v1 release_agent feature, caused by insufficient validation and authentication controls, allowing local attackers to execute arbitrary commands with elevated privileges.
A Linux kernel cgroups v1 release_agent improper authentication / privilege escalation vulnerability that can allow container escape and execution of arbitrary commands on the host.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.