CVE-2022-1011
📋 TL;DR
A use-after-free vulnerability in the Linux kernel's FUSE filesystem allows a local attacker to trigger write() operations that can lead to unauthorized data access and privilege escalation. This affects Linux systems with FUSE filesystems mounted. Local users with access to mount or write to FUSE filesystems are at risk.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Communications Cloud Native Core Binding Support Function by Oracle
View all CVEs affecting Communications Cloud Native Core Binding Support Function →
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
Enterprise Linux For Ibm Z Systems Eus by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems Eus →
Enterprise Linux For Power Little Endian by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux For Real Time For Nfv by Redhat
View all CVEs affecting Enterprise Linux For Real Time For Nfv →
Enterprise Linux For Real Time For Nfv Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time For Nfv Tus →
Enterprise Linux For Real Time Tus by Redhat
View all CVEs affecting Enterprise Linux For Real Time Tus →
Enterprise Linux Server Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →
Fedora by Fedoraproject
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges, accesses sensitive data, and potentially installs persistent backdoors or malware.
Likely Case
Local user escalates privileges to gain unauthorized access to files and system resources they shouldn't have access to.
If Mitigated
With proper access controls and unprivileged FUSE restrictions, impact is limited to data leakage within user's existing permissions.
🎯 Exploit Status
Exploit requires local access and knowledge of FUSE operations. Proof-of-concept code has been published in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.17.1 and later
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.17.1 or later. 2. For distributions: Apply vendor kernel updates. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable FUSE module
linuxPrevent loading of FUSE kernel module to eliminate attack surface
echo 'install fuse /bin/false' >> /etc/modprobe.d/fuse.conf
rmmod fuse
Restrict FUSE mounting
linuxLimit FUSE mounting to privileged users only
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.conf
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to systems
- Monitor for privilege escalation attempts and unusual FUSE activity
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is earlier than 5.17.1 and FUSE is loaded, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.17.1 or later: uname -r. Check that FUSE module is either not loaded or system has been patched.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to FUSE
- Unexpected privilege escalation events
- Failed FUSE operations in system logs
Network Indicators:
- None - this is a local exploit
SIEM Query:
source="kernel" AND ("FUSE" OR "use-after-free") OR event_type="privilege_escalation"🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2064855
- https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://www.debian.org/security/2022/dsa-5173
- https://www.oracle.com/security-alerts/cpujul2022.html
