Summary
CVE-2022-0995 is an out-of-bounds (OOB) memory write vulnerability located within the Linux kernel’s `watch_queue` event notification subsystem. This flaw allows a local, unprivileged user to overwrite sensitive kernel memory, which can be leveraged to escalate privileges to root or trigger a system-wide denial of service (DoS), making it a critical concern for systems utilizing affected kernel versions.
Exploitation
- Active Exploitation: There have been reports of active exploitation attempts following the public disclosure of the vulnerability.
- Threat Actors/Campaigns: While security researchers identified the vulnerability, no specific state-sponsored threat actors or widespread ransomware campaigns have been uniquely attributed to the weaponization of this specific CVE in public documentation.
- Proof-of-Concept/Exploit: Publicly available proof-of-concept (PoC) exploit code exists, including functional examples on platforms like GitHub that demonstrate local privilege escalation (LPE) techniques [1].
- Attack Prerequisites:
*
Access: Local access is required; it cannot be exploited remotely over a network.
*
Authentication: The attacker must have a user account on the target system.
*
User Interaction: No specific user interaction (beyond the initial access) is required.
Affected Products & Patches
- Affected Versions: The vulnerability affects various versions of the Linux kernel that include the `watch_queue` subsystem, which was introduced in kernel 5.8.
- Patch Availability: The Linux kernel maintainers addressed this flaw in stable release branches shortly after discovery. Users are advised to upgrade to patched kernel versions (e.g., 5.17.1, 5.16.15, 5.15.29, or later) provided by their respective Linux distribution vendors.
- Mitigations/Workarounds: If an immediate kernel update is not possible, organizations may consider disabling the `watch_queue` functionality if it is not required by system applications, or limiting access to user namespaces (unprivileged user namespaces) which are often required to trigger the exploit code.
Impact
- Capabilities: Successful exploitation grants the attacker full root privileges on the affected host, enabling them to bypass security controls, install persistence mechanisms, steal sensitive data, or install malware.
- Business Risk: For internet-facing servers (such as web or application servers), this vulnerability represents a severe "second-stage" risk. If an attacker gains low-privileged access through a separate web application vulnerability, CVE-2022-0995 provides the necessary path to achieve full system compromise, leading to total loss of confidentiality, integrity, and availability.