CVE-2022-1055

What it actually does

Use-after-free vulnerability in tc_new_tfilter within the Linux kernel traffic control subsystem that permits local privilege escalation when unprivileged user namespaces are enabled.

Why it matters to the business

Local attackers on affected Linux systems can obtain elevated privileges, potentially compromising the entire host; the flaw has been public for years with exploits available and affects a widely deployed kernel component.

How an attack unfolds

An attacker with local access creates a malicious traffic control filter via the tc utility or equivalent netlink calls while operating inside an unprivileged user namespace, triggering the use-after-free condition in tc_new_tfilter to corrupt kernel memory and execute arbitrary code for privilege escalation.

How to fix it

Upgrade the Linux kernel to commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 or any later mainline or distribution-patched version that contains the fix.

How to confirm the fix worked

Verify the running kernel commit or version contains 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5; recompile and boot-test with the patched tree; attempt reproduction of the tc_new_tfilter path under unprivileged namespaces to confirm the crash is eliminated.

Typical attack path

1. Obtain local shell access on target Linux system
2. Enable or enter an unprivileged user namespace
3. Invoke netlink operations to create a traffic control filter that triggers the use-after-free in tc_new_tfilter
4. Leverage resulting kernel memory corruption to escalate privileges to root

How to detect it

Review system logs for unexpected crashes or panics involving tc or netlink traffic control operations; inspect audit logs for privileged process creation following tc filter operations by non-root users; examine kernel memory dumps or kdump artifacts for signs of use-after-free exploitation in tc_new_tfilter.

What your security team should do

• Immediately upgrade all Linux kernels to a version containing commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
• Disable unprivileged user namespaces where operationally feasible until patches are applied
• Monitor for new exploit releases given the ExploitAvailable maturity and multi-year public disclosure