CVE-2022-20567

What it actually does

Use-after-free condition triggered by a race in pppol2tp_create allows kernel memory corruption when System privileges are already held.

Why it matters to the business

Attackers who already possess elevated local access can obtain full system control, increasing the chance of complete host compromise and data exposure on affected Linux-based systems.

How an attack unfolds

An attacker with System execution rights triggers the race window in the L2TP PPP creation path, reclaims the freed object, and leverages the resulting corruption for privilege escalation to root.

How to fix it

Update to a kernel containing the upstream fix for A-186777253. For gitlab-org/gitlab deployments apply one of the listed fixed commits: bb1fc4ced3acba3eebe87d99a8e2637c50329b8d or 6b3af3293e0cee73719bbfc4a7d9eacc2e3ead54.

How to confirm the fix worked

Verify the running kernel version contains the referenced upstream commit; confirm the pppol2tp module no longer exhibits the race under concurrent creation stress tests.

Typical attack path

1. Obtain System-level local access on a vulnerable Android or Linux kernel host
2. Invoke pppol2tp_create concurrently from multiple threads to hit the race
3. Perform heap grooming to replace the freed object with attacker-controlled data
4. Trigger use of the dangling pointer to corrupt kernel structures
5. Escalate to full root privileges and execute arbitrary code

How to detect it

Review kernel logs and audit trails for repeated L2TP PPP creation attempts from the same process; look for oops or panic messages referencing l2tp_ppp.c around the time of suspected escalation.

What your security team should do

• Prioritize kernel upgrades on all Android and Linux systems that expose L2TP PPP interfaces
• Restrict local System-level accounts and monitor for unexpected privilege changes
• Apply the specific gitlab-org/gitlab patches if the environment includes those package versions