CVE-2022-2586: Linux Kernel Use-After-Free Vulnerability
A use-after-free flaw was found in nftables cross-table in the net/netfilter/nftablesapi.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.
Other sources
It was discovered that a nft object or expression could reference a nft set on a different nft table leading to a use-after-free once that table was deleted.
— Microsoft
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
— Launchpad
Linux Kernel contains a use-after-free vulnerability in the nftobject, allowing local attackers to escalate privileges.
— CISA
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of nftobjects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.rt7.213.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.3.1.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2586?
CVE-2022-2586 is rated as a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2022-2586?
To fix CVE-2022-2586, update your system to the latest kernel versions as specified by your distribution's security advisories.
What types of systems are affected by CVE-2022-2586?
CVE-2022-2586 affects specific versions of the Linux kernel across various distributions, including Red Hat, Ubuntu, and Debian.
Can CVE-2022-2586 be exploited remotely?
No, CVE-2022-2586 requires local access to the system, making it exploit risk limited to privileged users.
What specifically causes the CVE-2022-2586 vulnerability?
CVE-2022-2586 is caused by a use-after-free flaw during the deletion of nf_tables, which can lead to system instability or privilege escalation.