CVE-2022-1016: Use After Free

Q: What is the severity of CVE-2022-1016?

CVE-2022-1016 is considered to have high severity due to its potential to allow local unprivileged attackers to exploit a use-after-free condition.

Q: How do I fix CVE-2022-1016?

To fix CVE-2022-1016, update to the recommended versions of the kernel as specified by your distribution.

Q: What systems are affected by CVE-2022-1016?

CVE-2022-1016 affects various versions of the Linux kernel across distributions like Red Hat and Debian.

Q: What type of vulnerability is CVE-2022-1016?

CVE-2022-1016 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem.

Q: Can CVE-2022-1016 lead to data exposure?

Yes, CVE-2022-1016 can lead to kernel information leaks, which may expose sensitive data.

Published Mar 22, 2022

Updated

A flaw was found in the Linux kernel in net/netfilter/nftablescore.c:nftdochain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.

Other sources

Uninitialized registers on stack in nftdochain can cause kernel pointer leakage to uninitialized memory.

— Red Hat

Affected Software

12 affected componentsFixes available

redhat/kernel-rt<0:4.18.0-425.3.1.rt7.213.el8

0:4.18.0-425.3.1.rt7.213.el8

redhat/kernel<0:4.18.0-425.3.1.el8

0:4.18.0-425.3.1.el8

redhat/kernel<0:5.14.0-162.6.1.el9_1

0:5.14.0-162.6.1.el9_1

redhat/kernel-rt<0:5.14.0-162.6.1.rt21.168.el9_1

0:5.14.0-162.6.1.rt21.168.el9_1

redhat/kernel<0:5.14.0-70.64.1.el9_0

0:5.14.0-70.64.1.el9_0

redhat/kernel-rt<0:5.14.0-70.64.1.rt21.135.el9_0

0:5.14.0-70.64.1.rt21.135.el9_0

Linux Linux kernel<=3.12

Linux Linux kernel>=3.13<=5.17

Linux Linux kernel=3.13-rc1

redhat Enterprise Linux=8.0

redhat Enterprise Linux=9.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:4.18.0-425.3.1.rt7.213.el8
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:4.18.0-425.3.1.el8
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:5.14.0-162.6.1.el9_1
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:5.14.0-70.64.1.el9_0
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:5.14.0-70.64.1.rt21.135.el9_0
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Configuration
On non-containerized deployments, disable user namespaces by setting user.max_user_namespaces=0 and apply it with sysctl -p /etc/sysctl.d/userns.conf; do not use this mitigation on containerized deployments such as Red Hat OpenShift Container Platform.
Red Hat Enterprise Linux user.max_user_namespaces = 0

Event History

Mar 22, 2022

Data Sourced

via Red Hat·07:46 AM

DescriptionSeverityAffected Software

Mar 28, 2022

CVE Published

03:00 PM

Aug 29, 2022

CVE Published

via MITRE·02:03 PM

Data Sourced

via MITRE·02:03 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3065-1

Frequently Asked Questions

What is the severity of CVE-2022-1016?