CVE-2022-2586
Linux Kernel Use-After-Free Vulnerability
Description
CVE-2022-2586 is a medium-severity use-after-free vulnerability in the Linux kernel's Netfilter nf_tables subsystem that allows a local attacker with low privileges to achieve denial of service and potential privilege escalation. The flaw occurs when an nft object or expression references an nft set on a different nft table, leading to a use-after-free condition when that table is deleted. With a CVSS v3.1 score of 5.3, this vulnerability affects Linux kernel versions up to 5.19.17 and version 6.0, and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 17, 2024. The EPSS score of 2.50% at the 85.1st percentile indicates notable exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 3.16, < 4.14.316; >= 4.15, < 4.19.256; >= 4.20, < 5.4.211; >= 5.5, < 5.10.137; >= 5.11, < 5.15.61; >= 5.16, < 5.18.18; >= 5.19, < 5.19.2 |
| canonical | ubuntu linux | 14.04; 16.04; 18.04; 20.04; 22.04 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586(Third Party Advisory)
- https://lore.kernel.org/netfilter-devel/[email protected]/T/#t(Mailing List, Patch)
- https://ubuntu.com/security/notices/USN-5557-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5560-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5560-2(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5562-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5564-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5565-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5566-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5567-1(Third Party Advisory)
- https://ubuntu.com/security/notices/USN-5582-1(Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2022/08/09/5(Mailing List)
- https://www.zerodayinitiative.com/advisories/ZDI-22-1118/(Third Party Advisory, VDB Entry)
- https://www.vicarius.io/vsociety/posts/use-after-free-vulnerability-linked-chain-between-nft-tables-cve-2022-2586(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2586(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-2586, but the vulnerability is a use-after-free (UAF) condition, which typically corresponds to CWE-416 (Use After Free). The flaw exists in the nf_tables component of the kernel's Netfilter framework. When an nft object or expression in one table references an nft set belonging to a different table, and the second table is subsequently deleted, the reference becomes a dangling pointer. Subsequent access to this freed memory can lead to kernel memory corruption, crashes, or arbitrary code execution in kernel context.
Impact Analysis
CVE-2022-2586 enables a locally authenticated attacker with low privileges to trigger a kernel use-after-free condition through the Netfilter nf_tables interface. The CVSS vector reflects a Local attack (AV:L) with High complexity (AC:H), meaning specific conditions must be met for successful exploitation. Low privileges (PR:L) are sufficient, as unprivileged users can interact with the nf_tables subsystem through user namespaces on many Linux distributions. Integrity (Low): the attacker may be able to modify kernel memory in limited ways, potentially corrupting data structures. Availability (High): the use-after-free condition can reliably trigger a kernel panic, causing a complete system crash and denial of service. While the CVSS score rates confidentiality impact as None, practical exploitation of kernel use-after-free vulnerabilities frequently leads to privilege escalation to root. The EPSS score of 2.50% at the 85.1st percentile and public exploit analysis confirm real-world exploitation risk. Affected distributions include Ubuntu 14.04 through 22.04, making this vulnerability relevant across many enterprise Linux deployments. The ransomware association is listed as unknown.
Exploit Maturity
CVE-2022-2586 has a mature exploit landscape with confirmed active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 17, 2024, confirming real-world attacks. A detailed exploit analysis by Vicarius documents the technical exploitation chain. The vulnerability was also tracked by the Zero Day Initiative as ZDI-22-1118. The kernel patch was submitted in August 2022, and multiple Ubuntu security notices (USN-5557-1 through USN-5582-1) were released to address the issue across various Ubuntu releases. The EPSS score of 2.50% at the 85.1st percentile indicates exploitation probability above the vast majority of CVEs. The ransomware association is unknown, but kernel privilege escalation vulnerabilities are commonly used as components in post-exploitation chains.
Remediation
-
Update the Linux kernel to a patched version that includes the Netfilter nf_tables fix. The kernel patch was merged in August 2022. For Ubuntu systems, apply the relevant security update from USN-5557-1 through USN-5582-1 depending on your release version.
-
Prioritize patching on multi-tenant and shared systems where unprivileged users can access the nf_tables interface through user namespaces. Container hosts and shared compute environments are at particular risk because the vulnerability can be triggered from within unprivileged containers on some configurations.
-
Restrict access to user namespaces as a temporary mitigation if kernel patching cannot be performed immediately. Setting
kernel.unprivileged_userns_clone=0via sysctl prevents unprivileged users from creating user namespaces, which is required to access the nf_tables subsystem without root privileges on many distributions. -
Audit affected systems for signs of exploitation by checking kernel logs for Netfilter-related crashes, unexpected kernel panics, and suspicious process elevation. Monitor for unauthorized root-level processes on systems running vulnerable kernel versions.
-
Establish a regular kernel patching cadence to ensure that future kernel vulnerabilities are addressed promptly. Kernel use-after-free vulnerabilities in Netfilter are a recurring class of issues, and maintaining current kernel versions is the most effective defense.
Technical Details
CVE-2022-2586 is a use-after-free vulnerability in the Linux kernel's Netfilter nf_tables subsystem with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, yielding a score of 5.3 (Medium). The Attack Vector is Local (AV:L), requiring the attacker to have local access or the ability to execute code on the target system. Attack Complexity is High (AC:H), reflecting the need to win race conditions or meet specific kernel state requirements for reliable exploitation. Privileges Required is Low (PR:L), as the nf_tables subsystem can be accessed through unprivileged user namespaces on many Linux distributions. User Interaction is None (UI:N). The technical mechanism involves cross-table references in the nf_tables framework. The nf_tables subsystem allows defining rules, sets, and objects within tables. The vulnerability occurs when an object or expression in one table references a set in a different table. When the table containing the referenced set is deleted, the set's memory is freed, but the reference from the first table remains. Subsequent operations that access this dangling reference trigger a use-after-free, which can corrupt kernel heap memory. Affected kernel versions include all releases up to 5.19.17 and version 6.0. The fix ensures proper reference counting and validation of cross-table set references.
Frequently Asked Questions
Is CVE-2022-2586 being actively exploited?
Yes. CISA added CVE-2022-2586 to the Known Exploited Vulnerabilities catalog in 2024, confirming active exploitation. Public exploit analysis is available, and the EPSS score of 2.50% at the 85.1st percentile indicates above-average exploitation probability.
What Linux versions are affected by CVE-2022-2586?
Linux kernel versions up to 5.19.17 and version 6.0 are affected. Ubuntu 14.04, 16.04, 18.04, 20.04, and 22.04 have all released security advisories for this vulnerability. Other distributions using affected kernel versions are also vulnerable.
Can CVE-2022-2586 be exploited from a container?
Potentially, yes. On systems where unprivileged user namespaces are enabled, the nf_tables subsystem can be accessed from within containers. This makes container hosts and shared compute environments particularly important to patch.
How do I fix CVE-2022-2586?
Update your Linux kernel to a version that includes the Netfilter nf_tables fix from August 2022. For Ubuntu systems, apply the appropriate security update (USN-5557-1 through USN-5582-1). As a temporary mitigation, disabling unprivileged user namespaces can restrict access to the vulnerable subsystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.