CVE-2022-49647 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-49647?

CVE-2022-49647 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's cgroup subsystem that occurs during process migration between control groups. When multiple threads are moved simultaneously with some performing identity migrations (no actual move) while others move between cgroups, the kernel can incorrectly release memory references, potentially leading to kernel crashes or privilege escalation. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's cgroup subsystem that occurs during process migration between control groups. When multiple threads are moved simultaneously with some performing identity migrations (no actual move) while others move between cgroups, the kernel can incorrectly release memory references, potentially leading to kernel crashes or privilege escalation. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific affected versions not explicitly listed, but based on commit history, likely affects multiple stable kernel versions before the fix was backported.

Operating Systems: All Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires cgroup functionality enabled (default in most distributions) and ability to manipulate cgroup process assignments.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or privilege escalation allowing attackers to gain root access and execute arbitrary code in kernel context.

🟠

Likely Case

System instability, kernel crashes, or denial of service due to memory corruption in the cgroup subsystem.

🟢

If Mitigated

Limited impact if systems have restricted cgroup operations or minimal process migration activity.

🌐 Internet-Facing: LOW - This requires local access to the system and ability to manipulate cgroup configurations.

🏢 Internal Only: MEDIUM - Malicious local users or compromised services could exploit this to escalate privileges or crash systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and understanding of cgroup operations. The specific sequence of cgroup manipulations described in the CVE is needed to trigger the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commit 05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27 or later backports

Vendor Advisory: https://git.kernel.org/stable/c/05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict cgroup operations

all

Limit access to cgroup manipulation to trusted users only by restricting permissions on cgroup filesystem.

chmod 750 /sys/fs/cgroup
setfacl -m u:trusteduser:rwx /sys/fs/cgroup

🧯 If You Can't Patch

Restrict shell access and process management capabilities to minimize attack surface
Implement strict access controls on /sys/fs/cgroup directory to prevent unauthorized cgroup operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories. Vulnerable if using unpatched kernel before fix commit.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched release from vendor. Check that commit 05f7658210d1d331e8dd4cb6e7bbbe3df5f5ac27 is present in kernel source.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
OOM killer messages related to cgroup
System crash/reboot events

Network Indicators:

None - this is a local vulnerability

SIEM Query:

EventID=41 OR Source="kernel" AND Message="panic" OR Message="Oops"

📊 Metadata

CVE ID: CVE-2022-49647

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (10.3th percentile)

Published: February 26, 2025

Last Updated: March 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49647, you might also want to check these: