CVE-2022-1055: Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel
A use-after-free exists in the Linux Kernel in tcnewtfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
Other sources
A use-after-free vulnerability was found in the tcnewtfilter function in net/sched/clsapi.c in the Linux kernel. The availability of local, unprivileged user namespaces allows privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.22.1.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.22.1.rt21.94.el9_0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 - Configuration
On non-containerized deployments of Red Hat Enterprise Linux 8, disable unprivileged user namespaces by setting user.max_user_namespaces to 0 (e.g., write user.max_user_namespaces=0 to /etc/sysctl.d/userns.conf and apply with sysctl -p /etc/sysctl.d/userns.conf). Do not use this mitigation on containerized deployments (e.g., Red Hat OpenShift Container Platform) because the functionality is needed.
Linux kernel (sysctl user namespaces) user.max_user_namespaces = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1055?
CVE-2022-1055 has a high severity due to its potential for local privilege escalation in the Linux Kernel.
How do I fix CVE-2022-1055?
To fix CVE-2022-1055, upgrade your kernel to a version higher than 0:4.18.0-425.3.1.rt7.213.el8 or 0:4.18.0-425.3.1.el8.
Which software is affected by CVE-2022-1055?
CVE-2022-1055 affects several versions of the Linux Kernel, specifically versions up to 5.17.
What types of systems are vulnerable to CVE-2022-1055?
Systems running unprivileged user namespaces on affected Linux kernel versions are vulnerable to CVE-2022-1055.
Is there a specific patch for CVE-2022-1055?
Yes, the recommended patches for CVE-2022-1055 are included in kernel versions starting from specific updates as detailed in the vulnerability report.