CVE-2022-22704
📋 TL;DR
CVE-2022-22704 is a privilege escalation vulnerability in zabbix-agent2 on Alpine Linux that allows local users to gain root privileges. The vulnerability occurs due to incorrect assumptions about systemd configuration handling. Only Alpine Linux systems running vulnerable versions of zabbix-agent2 are affected.
💻 Affected Systems
- zabbix-agent2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges on the system, enabling complete system compromise, data theft, and lateral movement.
Likely Case
Privileged service account or local user escalates to root, potentially compromising the monitoring system and gaining access to sensitive monitoring data.
If Mitigated
With proper access controls and minimal privileges, impact is limited to the zabbix-agent2 service scope.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability details and exploitation method are publicly documented in the Alpine Linux issue tracker.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.9-r1 and later
Vendor Advisory: https://gitlab.alpinelinux.org/alpine/aports/-/issues/13368
Restart Required: Yes
Instructions:
1. Update Alpine Linux packages: apk update && apk upgrade
2. Specifically update zabbix-agent2: apk upgrade zabbix-agent2
3. Restart the zabbix-agent2 service: rc-service zabbix-agent2 restart
🔧 Temporary Workarounds
Remove zabbix-agent2
linuxUninstall the vulnerable package if not needed
apk del zabbix-agent2
Restrict service permissions
linuxRun zabbix-agent2 with reduced privileges using systemd security features
Edit /etc/systemd/system/zabbix-agent2.service.d/security.conf with: [Service]
DynamicUser=yes
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
🧯 If You Can't Patch
- Isolate affected systems from critical infrastructure and sensitive data
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check installed zabbix-agent2 version: apk info zabbix-agent2 | grep versionCheck Version:
apk info zabbix-agent2 | grep versionVerify Fix Applied:
Verify version is 5.4.9-r1 or higher: apk info zabbix-agent2 | grep version📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation in audit logs
- zabbix-agent2 process running as root when configured otherwise
- Failed privilege escalation attempts in system logs
Network Indicators:
- Unusual outbound connections from zabbix-agent2 host
- Monitoring data exfiltration
SIEM Query:
process.name:"zabbix-agent2" AND user.name:"root" AND NOT parent.process.name:"systemd"