CVE-2022-0995
📋 TL;DR
CVE-2022-0995 is an out-of-bounds write vulnerability in the Linux kernel's watch_queue subsystem that allows a local attacker to overwrite kernel memory. This can lead to privilege escalation or denial of service. Any Linux system with the affected kernel versions is vulnerable.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, complete system compromise, or kernel panic causing system crash.
Likely Case
Local privilege escalation allowing attackers to gain root access on vulnerable systems.
If Mitigated
Limited impact if proper access controls restrict local user accounts and kernel protections are enabled.
🎯 Exploit Status
Exploit code is publicly available, but requires local access and some technical knowledge to execute successfully.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.17-rc2 and later, backported to stable kernels
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2063786
Restart Required: Yes
Instructions:
1. Update kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Disable watch_queue module
linuxRemove or disable the watch_queue kernel module if not needed
echo 'blacklist watch_queue' >> /etc/modprobe.d/blacklist.conf
rmmod watch_queue
Restrict local user access
allLimit local user accounts and implement strict access controls
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts
- Enable kernel hardening features like SELinux/AppArmor to limit impact
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r and compare with affected versions (5.8 to 5.17)Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.17-rc2 or later, or check with distribution-specific security updates📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Watch queue related errors in dmesg
- Unusual privilege escalation attempts
Network Indicators:
- Not applicable - local exploit only
SIEM Query:
Search for kernel version strings in system logs and correlate with exploit attempts🔗 References
- http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html
- http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2063786
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb
- https://security.netapp.com/advisory/ntap-20220429-0001/
- http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html
- http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2063786
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb
- https://security.netapp.com/advisory/ntap-20220429-0001/
