CVE-2022-30594: High severity Linux Linux kernel vulnerability
A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp.
Other sources
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.30.1.el9_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.12.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.30.1.rt21.102.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.12.1.rt21.175.el9_1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 3.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.17.2 - Configuration
Enable the SELinux policy with: setsebool -P deny_ptrace on
SELinux deny_ptrace = on - Configuration
Set kernel.yama.ptrace_scope to 3 with `sysctl -w kernel.yama.ptrace_scope=3`; make it persistent in /etc/sysctl.d/99-yama-ptrace_scope.conf.
Linux kernel kernel.yama.ptrace_scope = 3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-30594?
CVE-2022-30594 has a high severity rating as it allows attackers to bypass seccomp restrictions.
How do I fix CVE-2022-30594?
To fix CVE-2022-30594, update the Linux kernel to the latest patched version as specified in the security advisories.
Which versions of the Linux kernel are affected by CVE-2022-30594?
CVE-2022-30594 affects Linux kernel versions prior to 5.17.2 and certain versions within the 4.x and 5.x series.
What components are impacted by CVE-2022-30594?
CVE-2022-30594 impacts the Linux kernel, specifically within the PTRACE_SEIZE code path related to seccomp.
Is CVE-2022-30594 exploitable remotely?
CVE-2022-30594 is not remote; it requires local access to the system to exploit the vulnerability.