7.8

CVE-2022-0492

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.24 < 4.9.301
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.266
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.229
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.177
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.97
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.20
Linux ≫ Linux Kernel Version >= 5.16 < 5.16.6
Linux ≫ Linux Kernel Version5.17 Updaterc1
Linux ≫ Linux Kernel Version5.17 Updaterc2
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Redhat ≫ Virtualization Host Version4.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version8.2
Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version22.04 SwEditionlts
Fedoraproject ≫ Fedora Version35
Netapp ≫ H300e Version-
Netapp ≫ H300s Version-
Netapp ≫ H410c Version-
Netapp ≫ H410s Version-
Netapp ≫ H500e Version-
Netapp ≫ H500s Version-
Netapp ≫ H700e Version-
Netapp ≫ H700s Version-
Netapp ≫ Hci Compute Node Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 6.99% 0.911
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://bugzilla.redhat.com/show_bug.cgi?id=2051505
Patch
Third Party Advisory
Issue Tracking