Loading vulnerability…
Linux Kernel perf_event_open Race Condition Leading to Root Privilege Escalation
CVE-2022-1729 is a race-condition vulnerability in the Linux kernel performance-events subsystem involving perf_event_open(). Concurrent setup of performance-monitoring events, including a leading tracepoint event and hardware and software sub-events, can trigger a use-after-free. An unprivileged local attacker can exploit the flaw to obtain kernel-address information, achieve arbitrary execution, escalate privileges to root, or crash the system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise system confidentiality and integrity through kernel-address disclosure and root privilege escalation. The use-after-free can also cause a system crash, resulting in denial of service.
If you can’t patch tonight, do this now.
Red Hat states that no mitigation meeting its product-security criteria is available. The perf_event_paranoid setting controls unprivileged performance-event access, and values of 2 or greater prohibit kernel profiling by users without CAP_SYS_ADMIN; this restriction is not established as a complete workaround for this vulnerability.
Patch, then assume compromise.
Install the vendor-fixed kernel or kernel-rt packages for the exact distribution release and support channel, then reboot into the updated kernel. Fixed releases include RHEL 7 kernel 3.10.0-1160.71.1.el7 (RHSA-2022:5232), RHEL 8.1 SAP kernel 4.18.0-147.70.1.el8_1 (RHSA-2022:5636), RHEL 8.2 kernel 4.18.0-193.87.1.el8_2 (RHSA-2022:5220), and RHEL 8.4 kernel 4.18.0-305.57.1.el8_4 (RHSA-2022:5626). Separate updates apply to other extended-support and real-time streams. Verify remediation against the applicable vendor advisory because backported fixes may not be identifiable from the upstream kernel version alone.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.