A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.06524.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a kernel affected
Version Status Constraints
kernel 5.17 rc3 affected —

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:8.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*

Configuration 5 [-]

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 6 Extended Lifecycle Support
kernel-0:2.6.32-754.47.1.el6 cpe:/o:redhat:rhel_els:6 RHSA-2022:1417 2022-04-19T00:00:00Z
Red Hat Enterprise Linux 7
kernel-rt-0:3.10.0-1160.66.1.rt56.1207.el7 cpe:/a:redhat:rhel_extras_rt:7 RHSA-2022:4644 2022-05-18T00:00:00Z
kernel-0:3.10.0-1160.66.1.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2022:4642 2022-05-18T00:00:00Z
kpatch-patch cpe:/o:redhat:enterprise_linux:7 RHSA-2022:4655 2022-05-18T00:00:00Z
Red Hat Enterprise Linux 7.3 Advanced Update Support
kernel-0:3.10.0-514.101.1.el7 cpe:/o:redhat:rhel_aus:7.3 RHSA-2022:2189 2022-05-11T00:00:00Z
Red Hat Enterprise Linux 7.4 Advanced Update Support
kernel-0:3.10.0-693.103.1.el7 cpe:/o:redhat:rhel_aus:7.4 RHSA-2022:5157 2022-06-22T00:00:00Z
Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118)
kernel-0:3.10.0-957.94.1.el7 cpe:/o:redhat:rhel_aus:7.6 RHSA-2022:2186 2022-05-11T00:00:00Z
Red Hat Enterprise Linux 7.6 Telco Extended Update Support
kernel-0:3.10.0-957.94.1.el7 cpe:/o:redhat:rhel_tus:7.6 RHSA-2022:2186 2022-05-11T00:00:00Z
Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
kernel-0:3.10.0-957.94.1.el7 cpe:/o:redhat:rhel_e4s:7.6 RHSA-2022:2186 2022-05-11T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_e4s:7.6 RHSA-2022:2211 2022-05-11T00:00:00Z
Red Hat Enterprise Linux 7.7 Advanced Update Support
kernel-0:3.10.0-1062.67.1.el7 cpe:/o:redhat:rhel_aus:7.7 RHSA-2022:4717 2022-05-24T00:00:00Z
Red Hat Enterprise Linux 7.7 Telco Extended Update Support
kernel-0:3.10.0-1062.67.1.el7 cpe:/o:redhat:rhel_tus:7.7 RHSA-2022:4717 2022-05-24T00:00:00Z
Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
kernel-0:3.10.0-1062.67.1.el7 cpe:/o:redhat:rhel_e4s:7.7 RHSA-2022:4717 2022-05-24T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_e4s:7.7 RHSA-2022:4721 2022-05-24T00:00:00Z
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-348.20.1.rt7.150.el8_5 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2022:0819 2022-03-10T00:00:00Z
kernel-0:4.18.0-348.20.1.el8_5 cpe:/o:redhat:enterprise_linux:8 RHSA-2022:0825 2022-03-10T00:00:00Z
kpatch-patch cpe:/o:redhat:enterprise_linux:8 RHSA-2022:0849 2022-03-14T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
kernel-0:4.18.0-147.64.1.el8_1 cpe:/o:redhat:rhel_e4s:8.1 RHSA-2022:0823 2022-03-10T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_e4s:8.1 RHSA-2022:0851 2022-03-14T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_e4s:8.1 RHSA-2022:0958 2022-03-17T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
kernel-rt-0:4.18.0-193.79.1.rt13.129.el8_2 cpe:/a:redhat:rhel_eus:8.2::nfv RHSA-2022:0821 2022-03-10T00:00:00Z
kernel-0:4.18.0-193.79.1.el8_2 cpe:/o:redhat:rhel_eus:8.2 RHSA-2022:0820 2022-03-10T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_eus:8.2 RHSA-2022:0925 2022-03-15T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
kernel-rt-0:4.18.0-305.45.1.rt7.117.el8_4 cpe:/a:redhat:rhel_eus:8.4::nfv RHSA-2022:1413 2022-04-19T00:00:00Z
kpatch-patch cpe:/o:redhat:rhel_eus:8.4 RHSA-2022:1418 2022-04-19T00:00:00Z
kernel-0:4.18.0-305.45.1.el8_4 cpe:/o:redhat:rhel_eus:8.4 RHSA-2022:1455 2022-04-20T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Linux Subscribe
Linux Kernel Subscribe
Netapp Subscribe
H300e Subscribe
H300s Subscribe
H410c Subscribe
H410s Subscribe
H500e Subscribe
H500s Subscribe
H700e Subscribe
H700s Subscribe
Hci Compute Node Subscribe
Solidfire\, Enterprise Sds \& Hci Storage Node Subscribe
Solidfire \& Hci Management Node Subscribe
Redhat Subscribe
Codeready Linux Builder Subscribe
Codeready Linux Builder For Power Little Endian Subscribe
Enterprise Linux Subscribe
Enterprise Linux Eus Subscribe
Enterprise Linux For Ibm Z Systems Subscribe
Enterprise Linux For Ibm Z Systems Eus Subscribe
Enterprise Linux For Power Little Endian Subscribe
Enterprise Linux For Power Little Endian Eus Subscribe
Enterprise Linux For Real Time For Nfv Tus Subscribe
Enterprise Linux For Real Time Tus Subscribe
Enterprise Linux Server Aus Subscribe
Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Subscribe
Enterprise Linux Server Tus Subscribe
Enterprise Linux Server Update Services For Sap Solutions Subscribe
Rhel Aus Subscribe
Rhel E4s Subscribe
Rhel Els Subscribe
Rhel Eus Subscribe
Rhel Extras Rt Subscribe
Rhel Tus Subscribe
Virtualization Host Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2940-1 linux security update
Debian DLA Debian DLA DLA-2941-1 linux-4.19 security update
Debian DSA Debian DSA DSA-5095-1 linux security update
Debian DSA Debian DSA DSA-5096-1 linux security update
EUVD EUVD EUVD-2022-15629 A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
Ubuntu USN Ubuntu USN USN-5302-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5337-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5338-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5339-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5343-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5362-1 Linux kernel (Intel IOTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-5368-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5377-1 Linux kernel (BlueField) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html cve-icon cve-icon
http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html cve-icon cve-icon
http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.html cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2051505 cve-icon cve-icon
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-0492 cve-icon
https://security.netapp.com/advisory/ntap-20220419-0002/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-0492 cve-icon
https://www.debian.org/security/2022/dsa-5095 cve-icon cve-icon
https://www.debian.org/security/2022/dsa-5096 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-02T23:32:45.292Z

Reserved: 2022-02-04T00:00:00

Link: CVE-2022-0492

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-03-03T19:15:08.633

Modified: 2024-11-21T06:38:46.193

Link: CVE-2022-0492

cve-icon Redhat

Severity : Important

Publid Date: 2022-02-07T00:00:00Z

Links: CVE-2022-0492 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses