CVE-2022-0492 flaw in Linux Kernel feature allows container escape
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0492 | Linux Kernel Cgroups v1 release_agent Privilege Escalation and Container Escape CVE-2022-0492 is a missing-authorization/improper-authentication flaw (CWE-862/CWE-287) in the Linux kernel's cgroups v1 support, in the cgroup_release_agent_write function of kernel/cgroup/cgroup-v1.c. Under certain conditions — notably when an attacker can wield CAP_SYS_ADMIN within a user namespace, as in some container or user-namespace configurations — they can write to a cgroup v1 controller's release_agent file and cause an arbitrary command to run outside the namespace. Successful exploitation yields privilege escalation on the host and an unexpected bypass of container/namespace isolation, i.e. a container escape, which is why it matters for containerized infrastructure. Affected products include the Linux kernel as shipped by Debian, Red Hat (Enterprise Linux, CodeReady Linux Builder, Red Hat Virtualization Host), Canonical and Fedora, plus NetApp HCI/HCI-adjacent firmware (H300S, H410C, H410S, H500S, H700S) and Bootstrap OS. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-02 (ransomware use unknown), and a public proof-of-concept Docker container escape is available, so defenders should treat exploitation as in the wild. Do: Apply updated kernel packages from Debian, Red Hat, Canonical, or Fedora per vendor advisories, and NetApp firmware/Bootstrap OS updates per NetApp's security advisory; because the flaw is in CISA KEV, BOD 22-01 remediation timelines apply to federal agencies. If patching must wait, reduce exposure by disabling unprivileged user namespaces (e.g., user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0), preventing unprivileged write access to cgroups v1 release_agent files, and avoiding containers running with CAP_SYS_ADMIN. Audit container hosts and appliances for cgroups v1 mounts and user-namespace configurations, and monitor for exploitation given the public Docker-escape PoC and the KEV listing. | 7.8 | 6% | KEV PoC |
| masshundreds of millions of Linux servers, container hosts, and appliances (kernel is ubiquitous; NetApp HCI firmware adds thousands of appliances) |
Full article513 words · extracted from securityaffairs.com · click to collapse
A Linux kernel flaw, tracked as CVE-2022-0492, can allow an attacker to escape a container to execute arbitrary commands on the container host.
A now-patched high-severity Linux kernel vulnerability, tracked as CVE-2022-0492 (CVSS score: 7.0), can be exploited by an attacker to escape a container to execute arbitrary commands on the container host.
The issue is a privilege escalation flaw affecting the Linux kernel feature called control groups (groups), that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes.
“A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.” reads the advisory published for this flaw.
Major Linux distros, including Suse, Ubuntu, and Redhat, also published their own advisories.
The flaw resides in the cgroups v1 release_agent functionality which is executed after the termination of any process in the group.
The root cause of the problem is the cgroups implementation in the Linux kernel that did not properly restrict access to the feature. A local attacker could exploit this vulnerability to gain administrative privileges.
The vulnerability was discovered by the security researchers Yiqi Sun and Kevin Wang.
“On Feb. 4, Linux announced CVE-2022-0492, a new privilege escalation vulnerability in the kernel. CVE-2022-0492 marks a logical bug in control groups (cgroups), a Linux feature that is a fundamental building block of containers.” reads the analysis published by Palo Alto Networks Unit 42 researcher Yuval Avrahami. “The issue stands out as one of the simplest Linux privilege escalations discovered in recent times: The Linux kernel mistakenly exposed a privileged operation to unprivileged users.”
According to Palo Alto Networks, CVE-2022-0492 is caused by the lack of check that the process setting the release_agent file has administrative privileges (i.e. the CAP_SYS_ADMIN capability).
Attackers that can write to the release_agent file, can force the kernel into invoking a binary of their choosing with elevated privileges and take over the machine. Only processes with “root” privileges can write to the file.
“Because Linux sets the owner of the release_agent file to root, only root can write to it (or processes that can bypass file permission checks via the CAP_DAC_OVERRIDE capability). As such, the vulnerability only allows root processes to escalate privileges.” continues the analysis. “At first glance, a privilege escalation vulnerability that can only be exploited by the root user may seem bizarre. Running as root doesn’t necessarily mean full control over the machine: There’s a gray area between the root user and full privileges that includes capabilities, namespaces, and containers. In these scenarios where a root process doesn’t have full control over the machine, CVE-2022-0492 becomes a serious vulnerability.”
Users are recommended to apply the security fixes as soon as possible. Containers running AppArmor or SELinux security systems are not impacted.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SIM swapping)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/128742/security/cve-2022-0492-linux-kernel-flaw.html