CVE-2022-1016

What it actually does

Use-after-free in nft_do_chain allows a local unprivileged attacker to trigger improper return handling that leaks kernel memory contents.

Why it matters to the business

Attackers with local access can read sensitive kernel data, increasing risk of credential theft or further privilege escalation on affected systems; the issue has been public for years with exploit code available.

How an attack unfolds

A local attacker crafts netfilter nftables rules that force an early return path in nft_do_chain without satisfying preconditions, causing the kernel to reuse freed memory and leak information to user space; named campaigns have referenced similar Linux kernel race and use-after-free patterns.

How to fix it

Upgrade opnsense/core to commit dff8692b8a230b7a561f8e1fc1cd458318621097 or apply the equivalent kernel patch that enforces proper preconditions before return in nft_do_chain.

How to confirm the fix worked

Verify the installed kernel or opnsense/core revision contains commit dff8692b8a230b7a561f8e1fc1cd458318621097 and confirm nft_do_chain no longer permits the unsafe return path via source inspection or regression tests.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Load or manipulate nftables rules to reach nft_do_chain return path
3. Trigger use-after-free to read kernel memory via crafted packet or rule evaluation
4. Parse leaked data for pointers, credentials, or other kernel structures

How to detect it

Review system logs for unusual nftables rule loading or netfilter activity around the time of suspected access; inspect kernel audit logs or dmesg for memory-related warnings; correlate with threat actor references to Linux kernel use-after-free techniques.

What your security team should do

• Immediately apply the referenced commit or kernel update on all exposed systems
• Restrict local nftables rule creation to privileged users until patched
• Monitor for new public exploits given the exploit maturity rating
• Audit nftables configurations for complex rule sets that could trigger the flaw