Loading vulnerability…
CVE-2022-2586 is a use-after-free vulnerability in the Linux kernel nf_tables subsystem, in cross-table handling within net/netfilter/nf_tables_api.c. An nft object or expression can retain a reference to an nft set belonging to a different nft table. Deletion of the referenced table frees the set while the cross-table reference remains usable, creating a use-after-free condition.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains three proof-of-concept (PoC) exploits targeting use-after-free (UAF) vulnerabilities in the Linux kernel, specifically CVE-2022-2585 (POSIX CPU timer UAF), CVE-2022-2586 (nf_tables cross-table reference UAF), and CVE-2022-2588 (cls_route UAF). The structure consists of three C source files, each corresponding to one CVE, and a README.md providing context and references. The exploits are local privilege escalation PoCs that interact directly with kernel interfaces (such as netlink sockets and kernel objects) to trigger UAF conditions. No weaponized payloads are included; the code is intended for research and demonstration purposes. The endpoints involved are local files, netlink sockets, and kernel objects/tables. The repository is suitable for researchers or defenders seeking to understand or test these vulnerabilities on affected Linux systems.
This repository contains proof-of-concept (POC) exploit code for three Linux kernel vulnerabilities: CVE-2022-2585, CVE-2022-2586, and CVE-2022-2588. The structure includes three C source files (CVE-2022-2585.c, CVE-2022-2586.c, dirtycred.c) and a README.md file. Each C file targets a specific kernel vulnerability: - CVE-2022-2585.c demonstrates a UAF in POSIX CPU timers by manipulating timer objects and process forking/cloning. - CVE-2022-2586.c exploits a UAF in the netfilter nf_tables subsystem by creating and deleting tables, sets, and objects via netlink sockets, using the libmnl and libnftnl libraries. - dirtycred.c (related to CVE-2022-2588) targets a UAF in the cls_route traffic control filter, using raw netlink messages to manipulate kernel networking structures. All exploits are local privilege escalation POCs and require the attacker to execute code on a vulnerable Linux system. The README provides references to the original advisories and research papers. No weaponized payloads are included; the code is intended for research and demonstration purposes.
This repository contains a local privilege escalation (LPE) exploit for CVE-2022-2586, a use-after-free (UAF) vulnerability in the Linux kernel's nft_object subsystem. The main file, CVE-2022-2586.c, is a C program that leverages the vulnerability to gain root privileges on affected Linux systems. The exploit works by manipulating nftables objects to achieve a UAF condition, constructing a ROP chain to overwrite the kernel's modprobe_path with a path to a custom script (/tmp/x), and then triggering modprobe to execute this script as root. The script appends a new root user to /etc/passwd, granting the attacker root shell access. The exploit requires compilation with specific libraries and must be run on a vulnerable kernel. The repository also includes a README with basic usage instructions. Key fingerprintable endpoints include /tmp/p, /tmp/x, /etc/passwd, and /bin/unshare, as well as the use of localhost (127.0.0.1) for network triggering. The exploit is operational and provides a working payload for privilege escalation.
This repository contains a local privilege escalation exploit for CVE-2022-2586, a use-after-free vulnerability in the Linux kernel's nft_object subsystem. The main file, 'exploit.c', is a sophisticated C program that leverages kernel ROP chains and netfilter manipulation to gain root privileges. The exploit works by crafting a ROP chain to overwrite the kernel's modprobe_path with '/tmp/x', dropping a script at /tmp/x that adds a root user to /etc/passwd, and then triggering modprobe to execute this script as root. The exploit uses several file endpoints (/tmp/p, /tmp/x, /etc/passwd, /bin/unshare) and localhost networking (127.0.0.1:1337) as part of its operation. The README provides compilation instructions. The exploit is operational and provides a root shell if successful. The code is well-structured, with clear separation of setup, exploitation, and cleanup phases.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel nft_object use-after-free vulnerability listed as an additional finding by LinPEAS.
Linux kernel nf_tables cross-table use-after-free that may permit local privilege escalation.
Linux kernel nftables cross-table use-after-free that may enable local privilege escalation.
Linux kernel nftables cross-table use-after-free vulnerability that may enable local privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.