CVE-2022-0492
Linux Kernel Improper Authentication Vulnerability
Description
CVE-2022-0492 is a vulnerability in the Linux kernel's cgroups v1 release_agent feature, located in the cgroup_release_agent_write function in kernel/cgroup/cgroup-v1.c. The flaw is rooted in improper authentication and missing authorization: under certain circumstances the kernel allows the release_agent feature to be used to escalate privileges and unexpectedly bypass namespace isolation. A local, low-privileged user or a process running inside a container can abuse this missing authorization to gain root on the underlying host, making it a powerful container-escape primitive. It matters because it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, carries a HIGH severity rating of CVSS 7.8, sits in the 96th EPSS percentile, and is widely used for Docker and Kubernetes container escapes. Because the improper authentication and missing authorization both stem from the kernel failing to restrict a privileged operation, exploitation is reliable and well documented.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | h300s firmware | - |
| netapp | h410c firmware | - |
| netapp | h410s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | bootstrap os | - |
| linux | linux kernel | >= 2.6.24, < 4.9.301; >= 4.10, < 4.14.266; >= 4.15, < 4.19.229; >= 4.20, < 5.4.177; >= 5.5, < 5.10.97; >= 5.11, < 5.15.20; >= 5.16, < 5.16.6; 5.17 |
| debian | debian linux | 9.0; 10.0; 11.0 |
| redhat | codeready linux builder | 8.0; 8.2 |
| redhat | codeready linux builder for power little endian | 8.0; 8.2 |
| redhat | virtualization host | 4.0 |
| redhat | enterprise linux | 8.0 |
| redhat | enterprise linux eus | 8.2 |
| redhat | enterprise linux for ibm z systems | 8.0 |
| redhat | enterprise linux for ibm z systems eus | 8.0 |
| redhat | enterprise linux for power little endian | 8.0 |
| redhat | enterprise linux for power little endian eus | 8.0 |
| redhat | enterprise linux for real time for nfv tus | 8.0; 8.2 |
| redhat | enterprise linux for real time tus | 8.0; 8.2 |
| redhat | enterprise linux server aus | 8.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.html(Exploit, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=2051505(Issue Tracking, Patch, Third Party Advisory)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af(Patch, Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20220419-0002/(Third Party Advisory)
- https://www.debian.org/security/2022/dsa-5095(Third Party Advisory)
- https://www.debian.org/security/2022/dsa-5096(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0492(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
The Linux kernel does not adequately prove that a process is entitled to use the privileged cgroups v1 release_agent feature, so authentication logic that should gate this operation can be bypassed. As a result, a process that should not be trusted to register a host-executed program is treated as if it were, enabling privilege escalation and container escape.
Learn more: CWE-287 — Improper Authentication
CWE-862: Missing Authorization
No sufficient authorization check is performed when a process writes to the release_agent file, even though using this feature is a privileged action whose use should be tightly restricted. The absence of this check is the root cause of the privilege escalation, because the kernel executes the attacker-controlled path as root without verifying the actor is authorized.
Learn more: CWE-862 — Missing Authorization
Impact Analysis
This vulnerability requires local access (AV:L) and is low in attack complexity (AC:L), so an attacker on the system can trigger it reliably. It needs only low privileges (PR:L) and no user interaction (UI:N), which makes it readily reachable by a container process or an unprivileged local user. The scope is unchanged (S:U), but the impact to confidentiality, integrity, and availability is High (C:H/I:H/A:H) because successful exploitation leads to full host compromise through privilege escalation and container escape. These factors yield a CVSS 3.1 base score of 7.8 (HIGH). The EPSS score of 0.28973 (96.66th percentile) indicates a high level of real-world exploitation activity.
Exploit Maturity
CISA has confirmed active exploitation by adding CVE-2022-0492 to its Known Exploited Vulnerabilities (KEV) catalog. Public exploit / proof-of-concept is available via Packet Storm Security, and the flaw is commonly used as a Docker and Kubernetes container-escape primitive. Its EPSS score of 0.28973 (96.66th percentile) places it among the most likely to be exploited. There is no known ransomware association at this time.
Remediation
- Follow the CISA KEV required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
- Update the Linux kernel to a fixed version for your branch (for example >= 5.16.6, 5.15.20, 5.10.97, 5.4.177, 4.19.229, 4.14.266, or 4.9.301; see kernel.org patch commit 24f6008564183aa120d07c03d9289519c2fe02af) and apply your distribution's patches (Debian, Red Hat, NetApp, and Ubuntu live patches).
- As an interim mitigation, enable mandatory access control with AppArmor or SELinux (which blocks the
release_agentabuse), drop theCAP_SYS_ADMINcapability from containers, use user namespaces, and run containers unprivileged. - Monitor for unexpected writes to
release_agent, unexplained privilege escalations, and container breakout indicators. - For long-term hardening, enforce strict authorization and authentication checks for privileged kernel features and apply the principle of least privilege so that processes cannot reach operations they are not entitled to use.
Technical Details
The flaw lives in cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c, where the cgroups v1 release_agent feature can be used to escalate privileges and bypass namespace isolation. A process with sufficient but unprivileged-reachable access, for example CAP_SYS_ADMIN obtained within a user namespace, writes an attacker-controlled release_agent path that the kernel then executes as root on the host. The attack matches the CVSS vector of local access, low complexity, low privileges, and no user interaction, with full confidentiality, integrity, and availability impact. Both associated weaknesses apply here: the use of this feature should be tightly authenticated (CWE-287), yet the kernel performs no sufficient authorization check (CWE-862) before honoring the privileged operation.
Frequently Asked Questions
Is CVE-2022-0492 being actively exploited?
Yes. CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. A public proof-of-concept is available and the flaw is commonly used as a Docker and Kubernetes container-escape primitive. Its EPSS score of 0.28973 (96.66th percentile) places it among the most likely to be exploited.
What products are affected by CVE-2022-0492?
The vulnerability affects the Linux kernel across a broad range from 2.6.24 up to the fixed points (< 4.9.301, < 4.14.266, < 4.19.229, < 5.4.177, < 5.10.97, < 5.15.20, < 5.16.6, and 5.17). It also affects NetApp HCI firmware (H300S, H410C, H410S, H500S, H700S, and Bootstrap OS), Debian 9, 10, and 11, and multiple Red Hat Enterprise Linux products.
How do I fix CVE-2022-0492?
Update the Linux kernel to a fixed version for your branch (for example >= 5.16.6, 5.15.20, 5.10.97, 5.4.177, 4.19.229, 4.14.266, or 4.9.301) and apply your distribution's patches. As interim mitigations, enable AppArmor or SELinux, drop CAP_SYS_ADMIN from containers, use user namespaces, and run containers unprivileged.
How severe is CVE-2022-0492?
It is rated HIGH with a CVSS 3.1 base score of 7.8. Successful exploitation requires only local access and low privileges but leads to full host compromise through privilege escalation and container escape, with High impact to confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.