CVE-2022-1055
📋 TL;DR
CVE-2022-1055 is a use-after-free vulnerability in the Linux kernel's tc_new_tfilter function that allows local attackers to escalate privileges. The exploit requires unprivileged user namespaces to be enabled. This affects Linux systems with vulnerable kernel versions.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full root privilege escalation leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain root access on affected systems.
If Mitigated
Limited impact if unprivileged user namespaces are disabled or proper kernel hardening is in place.
🎯 Exploit Status
Exploit requires local access and unprivileged user namespaces. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
Vendor Advisory: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5. 2. Apply kernel live patches if available from your distribution. 3. Reboot system to load patched kernel.
🔧 Temporary Workarounds
Disable unprivileged user namespaces
linuxPrevents exploitation by disabling the required unprivileged user namespaces feature
sysctl -w kernel.unprivileged_userns_clone=0
🧯 If You Can't Patch
- Disable unprivileged user namespaces using sysctl kernel.unprivileged_userns_clone=0
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 is present: git log --oneline | grep 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5Check Version:
uname -rVerify Fix Applied:
Verify kernel version contains the fix commit: uname -r and check with distribution's security advisory📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs, unexpected privilege escalation in audit logs, suspicious tc filter operations
Network Indicators:
- None - this is a local exploit
SIEM Query:
Search for kernel panic events or privilege escalation patterns in system logs🔗 References
- http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
- https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
- https://security.netapp.com/advisory/ntap-20220506-0007/
- https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc
- http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
- https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
- https://security.netapp.com/advisory/ntap-20220506-0007/
- https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc
