CVE-2022-24122
📋 TL;DR
CVE-2022-24122 is a use-after-free vulnerability in the Linux kernel's ucount.c that allows privilege escalation when unprivileged user namespaces are enabled. A ucounts object can outlive its namespace, leading to memory corruption. This affects Linux systems with kernel versions 5.14 through 5.16.4 where unprivileged user namespaces are enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Full root privilege escalation allowing complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation from unprivileged user to root, enabling lateral movement and further system exploitation.
If Mitigated
Limited impact if unprivileged user namespaces are disabled or proper kernel hardening is in place.
🎯 Exploit Status
Exploitation requires local access and unprivileged user namespace capability. Proof-of-concept code exists in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.16.5 and later
Vendor Advisory: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5
Restart Required: Yes
Instructions:
1. Update kernel to version 5.16.5 or later. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable unprivileged user namespaces
linuxPrevents exploitation by disabling the vulnerable feature
echo 0 > /proc/sys/kernel/unprivileged_userns_clone
sysctl -w kernel.unprivileged_userns_clone=0
🧯 If You Can't Patch
- Disable unprivileged user namespaces via sysctl
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If between 5.14 and 5.16.4, check if unprivileged user namespaces are enabled: sysctl kernel.unprivileged_userns_cloneCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is 5.16.5 or later: uname -r. Confirm patch is applied by checking kernel changelog or verifying commit f9d87929d451d3e649699d0f1d74f71f77ad38f5 is present.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to ucount.c
- Unexpected privilege escalation events in audit logs
- Failed namespace creation attempts
Network Indicators:
- Unusual outbound connections from previously unprivileged users
SIEM Query:
source="kernel" AND ("ucount" OR "use-after-free") OR event_type="privilege_escalation" AND user_namespace="true"🔗 References
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5
- https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSR3AI2IQGRKZCHNKF6S25JGDKUEAWWL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVSZKUJAZ2VN6LJ35J2B6YD6BOPQTU3B/
- https://security.netapp.com/advisory/ntap-20220221-0001/
- https://www.openwall.com/lists/oss-security/2022/01/29/1
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5
- https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSR3AI2IQGRKZCHNKF6S25JGDKUEAWWL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVSZKUJAZ2VN6LJ35J2B6YD6BOPQTU3B/
- https://security.netapp.com/advisory/ntap-20220221-0001/
- https://www.openwall.com/lists/oss-security/2022/01/29/1
