HighPublic exploitVulnerability

CVE-2022-32250

Linux Netfilter nf_tables Use-After-Free Privilege Escalation

Published Jun 2, 2022 · Updated 11 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 2 in a dayToday

CVSS7.8High · v3.1

EPSS2.9%87th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendors: Debian ProjectFedora ProjectNetAppLinux

IdentifiersCVE-2022-32250CWE-416 · Use After Free

CVE-2022-32250 is a use-after-free write vulnerability in the Linux kernel Netfilter nf_tables subsystem, affecting upstream kernels through 5.18.1. An incorrect NFT_STATEFUL_EXPR check in stateful-expression handling allows a local user able to create user and network namespaces to trigger kernel memory corruption and escalate privileges to root. Distribution-specific exposure depends on kernel backports and applied fixes. CVE-2022-1966 was rejected as a duplicate of this vulnerability.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can give a low-privileged local attacker root-level control, compromising host confidentiality, integrity, and availability. The memory-corruption condition can also cause a kernel crash and denial of service, and potentially permit arbitrary code execution in kernel context.

Mitigation

If you can’t patch tonight, do this now.

Restrict unprivileged creation of user and network namespaces where operationally feasible. For non-containerized RHEL 8 deployments, set user.max_user_namespaces to 0 to prevent creation of user namespaces. Do not apply this workaround indiscriminately to containerized deployments such as OpenShift, where user namespaces are required; use an appropriate vendor-supported fix instead.

Remediation

Patch, then assume compromise.

Install a distribution-supported kernel update explicitly addressing CVE-2022-32250 and reboot into the updated kernel. Confirmed fixed packages include RHEL 7 kernel 3.10.0-1160.71.1.el7, RHEL 8.2 extended-support kernel 4.18.0-193.87.1.el8_2, and RHEL 8 kernel 4.18.0-372.19.1.el8_6; other release channels require their corresponding vendor updates. Where supported, install and verify activation of a vendor-provided kpatch live patch for the exact running kernel instead of relying on a conventional kernel replacement.

Public exploits

Exploits

6 exploits validated by Mallory's analysis. Hidden: 3 not yet analyzed, such as Exploit-DB entries.

View more in app →

CVE-2022-32250-exploitThis repository contains a local privilege escalation exploit for CVE-2022-32250, a use-after-free vulnerability in the Linux kernel's nftables subsystem. The exploit is implemented in a single C file (exp.c) and is designed to be compiled and run on a vulnerable Linux system (such as Ubuntu 22.04 with kernel 5.15.0-27-generic, prior to the relevant security patch). The exploit works by manipulating kernel memory structures via netfilter/nftables and message queues, leaking kernel addresses, and ultimately overwriting the modprobe_path to execute a custom payload. The payload is a simple C program that, when executed, provides a root shell. The exploit creates and uses several temporary files in /tmp, including /tmp/shell.c (the payload source), /tmp/shell (the setuid root shell), and /tmp/dummy (a helper file). The README.md provides background, references, affected versions, and usage instructions. The exploit is operational and provides a working local root shell if successful, but may cause kernel panics due to kernel memory corruption.theori-io · Disclosed Aug 24, 2022 · c · localOperational CVE-2022-32250This repository contains a Linux kernel local privilege escalation exploit targeting the nftables/netfilter subsystem. The main file, 'exploit.c', is a large C program that interacts with the kernel via netlink sockets using the libmnl and libnftnl libraries. It constructs and sends crafted netlink messages to manipulate kernel memory and trigger a vulnerability, ultimately executing a kernel ROP chain. The ROP chain calls commit_creds(prepare_kernel_cred(0)) to escalate privileges to root, switches namespaces, and returns to usermode to execute a shell as root. The exploit is operational, with hardcoded kernel offsets and gadgets, meaning it is tailored for specific kernel versions. The exploit requires local access to the target system and appropriate kernel configuration. The repository also includes a header file ('exploit.h') with data structures and enums relevant to nftables and kernel exploitation. No network endpoints or remote attack vectors are present; the attack is purely local and targets the Linux kernel via netlink communication.Kristal-g · Disclosed Jun 9, 2024 · c · localOperational cve-2022-32250This repository is a full exploit environment for CVE-2022-32250, a Linux kernel privilege escalation vulnerability in the netfilter/nftables subsystem. The structure includes scripts and Dockerfiles to build a vulnerable Linux 5.15.44 kernel and root filesystem, run it in QEMU, and facilitate debugging. The main exploit code is in C (exploit/src/main.c.bck, base.c, helpers.h, consts.h, prelude.h) and orchestrates a complex local attack: it sets up user and network namespaces, manipulates netfilter tables and sets via netlink sockets, and abuses kernel heap structures to overwrite the modprobe_path. The exploit then places a malicious script at the new modprobe path and triggers it via a crafted binary, resulting in a setuid root shell at /tmp/get_shell. The payload is a simple C program that spawns a root shell. The exploit is operational and requires local code execution on a vulnerable Linux system. The repository is well-structured for research and testing, with build automation and QEMU integration for safe analysis.g3un · Disclosed Jun 30, 2025 · c · bash · localOperational CVE-2022-32250The repository contains a single file, `expo1`, which is a compiled 64-bit ELF Linux executable rather than source code. It is not a framework module and appears to be a standalone local privilege-escalation exploit. Static strings and imported symbols strongly indicate the binary targets the Linux kernel netfilter/nftables subsystem using libmnl and libnftnl to craft and send netlink messages. Relevant imported functions include `mnl_socket_open`, `mnl_socket_sendto`, `nftnl_table_alloc`, `nftnl_set_alloc`, `nftnl_expr_alloc`, `nftnl_nlmsg_build_hdr`, `nftnl_table_nlmsg_build_payload`, `nftnl_set_nlmsg_build_payload`, and batch helpers, which are typical of nftables object creation/manipulation during exploitation. The binary also imports `unshare`, `sched_setaffinity`, `fork`, `syscall`, `mmap`, `mq_open`, `mq_send`, `mq_receive`, `msgsnd`, `read`, `write`, `system`, and `execve`. This suggests a full exploit chain that sets up process state, possibly isolates namespaces, performs heap or race-oriented kernel interaction, and then launches a privileged command/shell upon success. No external network C2, URLs, or remote IP/domain endpoints are visible in the provided content. The only fingerprintable artifacts are local ELF/library paths and shared object names. Because only a stripped/truncated binary is provided, exact CVE attribution and the final spawned command cannot be confirmed from the available data alone. However, the structure and symbol set are consistent with an operational Linux local root exploit against nftables/netfilter-related kernel logic, not a detection script or benign utility.Noidolosity · Disclosed Mar 25, 2026 · c · localOperational CVE-2022-32250-exploitThis repository is a compact local privilege-escalation exploit for CVE-2022-32250, consisting of a README and a single C source file, exp.c. It is not part of a larger exploit framework. The README documents the vulnerability, affected Linux/Ubuntu versions, build command, and warns that exploitation may panic the kernel. The exploit targets a Linux kernel nf_tables use-after-free caused by an incorrect NFT_STATEFUL_EXPR check. The code is a real LPE exploit rather than a detector: it performs multi-stage heap manipulation and kernel object overlap using nftables objects together with keyrings, POSIX/System V message queues, and io_uring allocations. The visible structure shows staged exploitation: setup of stable nftables tables/sets, heap address leak, KASLR/kernel address leak, and a final arbitrary overwrite aimed at modprobe_path. Key capabilities visible in the code include: creating nftables tables and trigger sets; spraying keyrings via add_key/keyctl; spraying and gathering message queues; spraying io_uring objects; leaking heap and kernel-related addresses; and using the resulting write primitive to redirect modprobe_path. The embedded payload is operational and hardcoded: it prepares /tmp/shell.c containing a program that spawns bash when executed as root, creates a dummy malformed file /tmp/dummy, and installs a modprobe script that sets ownership and mode 4555 on /tmp/shell. This yields a local root shell. Fingerprintable artifacts are primarily local rather than network-based: /tmp/shell.c, /tmp/dummy, /tmp/shell, the implicit modprobe_path target (/proc/sys/kernel/modprobe), and nftables object names such as table1-table4 and set_trigger0-set_trigger5. No external network endpoints, C2, URLs, or remote services are used by the exploit code itself. Overall, this is an operational Linux kernel LPE PoC/exploit for vulnerable pre-patch kernels, with a concrete privilege-escalation payload and significant risk of kernel instability during execution.Theori-lO · Disclosed Apr 29, 2026 · c · markdown · localOperational CacheMeIfYouCanRepository purpose: a Linux kernel exploitation lab/PoC built around a custom vulnerable kernel driver interface (/dev/rdd) and an allocation primitive device (/dev/allocdev), with supporting VM tooling (disk image + initramfs) and GDB helper scripts for low-level memory/page-table/TLB inspection. Key components: - vmachine/exploit.c (C, ~22KB): main interactive exploit program. It defines a msg_t structure and three ioctls (RDD_ALLOC/RDD_FREE/RDD_READ) used to drive a kernel object lifecycle (allocate/free/read). It also implements heap spraying by repeatedly opening /dev/allocdev, and a timing side-channel using rdtsc around keyutils add_key() with an invalid description. The program includes routines to allocate a page and instruct the operator to convert it into a 1GB huge-page mapping by manually editing the PUD entry via GDB (walk_pgd script). It includes a TLB flush trick that relies on specific kernel configuration (KPTI enabled, PCID disabled). It can forward measurement results to the host via a virtio-serial port (/dev/virtio-ports/exploit_data), implying a QEMU-based setup. - gdbscripts/*.py (Python): custom GDB commands to (1) search QEMU TLB entries (monitor info tlb), (2) shift bytes in memory (manual patching), (3) walk a SLUB freelist from a head pointer and offset (heap debugging), and (4) walk page tables for a virtual address by reading CR3 and traversing PGD/PUD/PMD/PTE entries using a fixed phys->virt offset (0xffff888000000000). - scripts/pack_initramfs.sh and scripts/unpack_initramfs.sh (sh): manage initramfs.cpio.gz; pack script sets SUID on busybox inside initramfs (4755) and forces root ownership in the cpio archive. - setup.sh (bash): downloads Linux 6.2 tarball from kernel.org and creates/formats a 2GB raw disk image for the VM using qemu-img + losetup + mkfs.ext4. - vmachine/initramfs/bin/*: busybox applet stubs/symlinks for a minimal initramfs userland. Exploit capabilities (as implemented/observable from provided code excerpt): - Local kernel heap grooming: spray allocations via /dev/allocdev; obtain “fresh slab” and “populate slab” menu actions (functions referenced in the menu; full bodies not visible due to truncation). - Kernel object lifecycle control via /dev/rdd ioctls: allocate/free/read primitives (typical building blocks for UAF/infoleak exploitation). - Timing measurement around add_key() to infer allocation behavior; results can be exported to host via virtio-serial. - Page-table/TLB manipulation workflow assisted by GDB scripts, including guidance for creating huge-page mappings and flushing TLB under certain mitigations. No explicit CVE is referenced in the visible content; targeting appears to be a specific lab kernel (6.2) plus custom devices/drivers rather than a generic remote exploit. Overall maturity is best classified as PoC/lab exploit: interactive, environment-dependent, and requiring manual GDB steps for some stages.LSinus · Disclosed Feb 23, 2026 · c · python · local (Linux kernel exploitation via device ioctls + heap grooming + page-table/TLB manipulation)PoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Debian ProjectDebian Linuxoperating_system

Fedora ProjectFedoraoperating_system

LinuxLinux Kerneloperating_system

NetAppH300s Firmwareoperating_system

NetAppH410c Firmwareoperating_system

NetAppH410s Firmwareoperating_system

NetAppH500s Firmwareoperating_system

NetAppH700s Firmwareoperating_system

External references

References

Activity feed

Recent activity

36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable nessus pluginsNews · Oct 18, 2026CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel /... | Tenable®Referenced by a CentOS 8.4 security check and used as its CVSS v2 score source. The vector describes local access, low attack complexity, no authentication, and complete confidentiality, integrity, and availability impacts. No flaw-level technical description is provided.Read more ↗tenable nessus pluginsNews · Oct 18, 2026CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel /... | Tenable®Included in the CentOS 8.5 security update and used as the source for the plugin's CVSS v2 vector, indicating local access, low attack complexity, no authentication, and complete confidentiality, integrity, and availability impacts. The plugin's aggregate exploit and CISA KEV statements are not attributed to individual CVEs.Read more ↗redhat accessNews · Sep 23, 2026RHSA-2022:6051 - Security Advisory - Red Hat Customer PortalListed as associated with the security advisory; the content does not describe its mechanism or impact.Read more ↗redhat accessNews · Jan 1, 2026RHSA-2022:5626 - Security Advisory - Red Hat Customer PortalLinux kernel netfilter use-after-free write vulnerability that can allow local privilege escalation to root.Read more ↗

+31 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.