CVE-2022-2588

What it actually does

Use-after-free in the cls_route filter hashtable when a filter handle of zero is processed, allowing the kernel to free a structure that remains referenced and enabling arbitrary memory corruption from local context.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges to root, execute arbitrary code, or crash the kernel, leading to full host compromise or denial of service across servers, containers, and endpoints running vulnerable kernels.

How an attack unfolds

An attacker with local access crafts a tc filter rule using cls_route with a handle value of zero, triggers the removal path that frees the object without deleting the hashtable entry, then re-allocates and re-uses the dangling pointer to corrupt kernel memory and achieve code execution.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the cls_route hashtable removal logic; apply vendor backports for Ubuntu and other distributions; rebuild and reboot into the patched kernel; where immediate patching is impossible, restrict unprivileged local access and tc filter creation via SELinux or AppArmor policies.

How to confirm the fix worked

Verify the running kernel version against vendor advisories; inspect kernel source or binary for the corrected cls_route filter removal sequence; run regression tests that exercise tc filter creation and deletion with handle zero; confirm no crash or corruption occurs under those conditions.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Load or craft malicious traffic-control filter rules via cls_route with handle=0
3. Trigger the faulty removal path to create a dangling pointer
4. Spray or re-allocate kernel objects to control the freed memory
5. Overwrite function pointers or data structures for privilege escalation or kernel code execution

How to detect it

Review system logs for kernel oops or panic messages referencing cls_route or hashtable operations around the time of suspected activity; inspect audit logs for unusual tc filter creation commands executed by non-root users; correlate with process execution of tools that manipulate traffic control rules.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux hosts within the next patch cycle
• Restrict unprivileged users from creating traffic-control filters using mandatory access controls until patches are applied
• Monitor for new exploit code and update detection rules once public PoCs appear
• Audit container host kernels for exposure since downstream images inherit the underlying kernel vulnerability