CVE-2022-24122

What it actually does

Use-after-free in kernel/ucount.c when unprivileged user namespaces are enabled, allowing a ucounts object to outlive its namespace and enabling local privilege escalation in Linux kernel versions 5.14 through 5.16.4.

Why it matters to the business

Local attackers can obtain full root access on affected systems, leading to complete compromise of servers, containers, or developer workstations and potential disruption of operations.

How an attack unfolds

An attacker with local access enables unprivileged user namespaces, triggers the reference-counting flaw to cause a ucounts object to be freed while still referenced, then reuses the freed memory to execute arbitrary code and escalate privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit f9d87929d451d3e649699d0f1d74f71f77ad38f5 or later; apply the fixed version from the torvalds/linux repository; if immediate patching is not possible, disable unprivileged user namespaces via kernel command line or sysctl.

How to confirm the fix worked

Verify the running kernel version includes commit f9d87929d451d3e649699d0f1d74f71f77ad38f5, confirm unprivileged user namespaces are restricted where possible, and retest with proof-of-concept code that previously triggered the flaw.

Typical attack path

1. Obtain local shell access on target system
2. Enable unprivileged user namespaces via kernel configuration or sysctl
3. Execute crafted code that manipulates user namespace ucounts to trigger use-after-free
4. Leverage freed object for memory corruption and kernel code execution
5. Escalate to root and install persistence or move laterally

How to detect it

Review kernel audit logs and dmesg for user namespace creation events followed by unusual memory or process behavior; search system logs for crashes or privilege changes around namespace-related syscalls.

What your security team should do

• Prioritize kernel upgrades on all systems running versions 5.14-5.16.4
• Restrict unprivileged user namespaces via /proc/sys/kernel/unprivileged_userns_clone where feasible
• Monitor kernel logs and auditd for namespace creation anomalies
• Review container runtime configurations that rely on user namespaces