Vulnerability · Published Jun 2, 2022 · Assigned by mitre
CVE-2022-32250
High 7.8
In plain English
A high-severity security flaw in the bpftool package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)2.9%top 12.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-core | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-debug | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-devel | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-doc | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-headers | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-modules | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-rt | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-core | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug-core | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug-devel | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug-modules | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-devel | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-kvm | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-modules | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-rt-modules-extra | 4.18.0-372.19.1.rt7.176.el8_6 | ALSA-2022:5834 |
| AlmaLinux:8 | kernel-tools | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | perf | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| AlmaLinux:8 | python3-perf | 4.18.0-372.19.1.el8_6 | ALSA-2022:5819 |
| Debian:12 | linux | 5.18.2-1 | DEBIAN-CVE-2022-32250 |
| Debian:13 | linux | 5.18.2-1 | DEBIAN-CVE-2022-32250 |
| Debian:14 | linux | 5.18.2-1 | DEBIAN-CVE-2022-32250 |
| Rocky Linux:8 | kernel | 0:4.18.0-372.19.1.el8_6 | RLSA-2022:5819 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-372.19.1.rt7.176.el8_6 | RLSA-2022:5834 |
| Ubuntu:22.04:LTS | linux | 5.15.0-37.39 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1011.14 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1010.12 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1008.12 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1008.10 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1007.8 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1008.11 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1010.11 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-37.39 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1011.12 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1009.12 | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1011.13 | UBUNTU-CVE-2022-32250 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2022-32250 |
| Ubuntu:22.04:LTS | linux-riscv | 5.15.0-1014.16 | UBUNTU-CVE-2022-32250 |
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2022/05/31/1 x_refsource_MISC
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/net/netfilter?id=520778042ccca019f3ffa136dd0ca565c486cedd x_refsource_MISC
- [oss-security] 20220603 Re: Linux Kernel use-after-free write in netfilter mailing-list, x_refsource_MLIST
- [oss-security] 20220604 Re: Linux Kernel use-after-free write in netfilter mailing-list, x_refsource_MLIST
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6Y3TC4WUUNKRP7OQA26OVTZTPCS6F2/ x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZTJOJCVVEJVOQSCHE6IJQKMPISHQ5L/ x_refsource_MISC
- https://www.debian.org/security/2022/dsa-5161 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=2092427 x_refsource_MISC
- [oss-security] 20220620 Re: Linux Kernel use-after-free write in netfilter mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update mailing-list, x_refsource_MLIST
- [oss-security] 20220703 Re: Linux kernel: Netfilter heap buffer overflow: Is this CVE-2022-32250? mailing-list, x_refsource_MLIST
- [oss-security] 20220703 Linux kernel: Netfilter heap buffer overflow: Is this CVE-2022-32250? mailing-list, x_refsource_MLIST
- DSA-5173 vendor-advisory, x_refsource_DEBIAN
- https://security.netapp.com/advisory/ntap-20220715-0005/ x_refsource_CONFIRM
- [oss-security] 20220825 Re: Linux Kernel use-after-free write in netfilter mailing-list, x_refsource_MLIST
- https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/ x_refsource_MISC
- https://github.com/theori-io/CVE-2022-32250-exploit x_refsource_MISC
- [oss-security] 20220902 Re: Linux Kernel use-after-free write in netfilter mailing-list, x_refsource_MLIST
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html