CVE-2022-0492: Linux Kernel Improper Authentication, actively exploited

Description

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Netapp Solidfire, Enterprise Sds & Hci Storage Nodeall versions

Netapp Solidfire & Hci Management Nodeall versions

Redhat Codeready Linux Builder8.0 · 8.2

Redhat Codeready Linux Builder For Power Little Endian8.0 · 8.2

Redhat Virtualization Host4.0

Canonical Ubuntu Linux14.04 · 16.04 · 18.04 · 20.04

Debian Linux10.0 · 11.0 · 9.0

Fedoraproject Fedora35

Linux Kernel≥ 2.6.24 < 4.9.301 · ≥ 4.10 < 4.14.266 · ≥ 4.15 < 4.19.229 · ≥ 4.20 < 5.4.177

Netapp Bootstrap OSall versions

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H700s Firmwareall versions

Redhat Enterprise Linux8.0

Redhat Enterprise Linux Eus8.2

Redhat Enterprise Linux For Ibm Z Systems8.0

Redhat Enterprise Linux For Ibm Z Systems Eus8.0

Redhat Enterprise Linux For Power Little Endian8.0

Redhat Enterprise Linux For Power Little Endian Eus8.0

Redhat Enterprise Linux For Real Time For Nfv Tus8.0 · 8.2

Redhat Enterprise Linux For Real Time Tus8.0 · 8.2

Redhat Enterprise Linux Server Aus8.2

Remediation

Fixed in

Linux Kernel≥ 4.9.301

Patch & vendor advisories

References

http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.htmlExploitVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=2051505Issue TrackingPatchThird Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02afPatchVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00011.htmlMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20220419-0002/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0492US Government Resource
https://www.debian.org/security/2022/dsa-5095Third Party Advisory

and 1 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-0492 being actively exploited?

Yes. CVE-2022-0492 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2 Jun 2026.

How severe is CVE-2022-0492?

CVE-2022-0492 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 5.53% probability of exploitation.

Which products are affected by CVE-2022-0492?

Affected products include Netapp Solidfire, Enterprise Sds & Hci Storage Node, Netapp Solidfire & Hci Management Node, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder For Power Little Endian, Redhat Virtualization Host, and 19 more.

How do I fix CVE-2022-0492?

Upgrade affected software to a fixed version, for example Linux Kernel 4.9.301 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-0492 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo