CVE-2022-2602

What it actually does

Use-after-free condition in the Linux kernel io_uring subsystem triggered during Unix SCM rights garbage collection, allowing an attacker to reference freed kernel memory structures.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges to kernel level, potentially compromising the entire host including containers and services; the issue has been public for over 1000 days with stable but non-zero exploit probability.

How an attack unfolds

An attacker with local access crafts io_uring submission queue entries that register Unix domain sockets carrying SCM rights; during garbage collection a race frees a structure that is later dereferenced, enabling arbitrary read/write or code execution in kernel context. Related exploitation patterns have been observed in container-optimized environments and other Linux kernel UAF chains.

How to fix it

Upgrade the Linux kernel to a version containing the fix for this use-after-free; apply distribution-specific updates for Ubuntu and other affected releases as soon as available.

How to confirm the fix worked

Confirm kernel version is newer than the vulnerable range; review kernel build configuration to ensure io_uring and Unix SCM support match patched code; run regression tests exercising io_uring with SCM rights.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Create io_uring instance and register Unix SCM socket file descriptors
3. Trigger concurrent garbage collection and io_uring operation to induce UAF
4. Reuse freed memory to corrupt kernel structures for privilege escalation
5. Execute payload to gain root or escape container

How to detect it

Search kernel logs and audit trails for repeated io_uring and unix_scm related warnings or crashes; inspect process creation events following io_uring activity for unexpected privilege changes; correlate with container escape attempts in orchestration logs.

What your security team should do

• Prioritize kernel updates on all production Linux systems within change windows
• Restrict unprivileged io_uring usage via sysctl where business needs allow
• Monitor for new fixed kernel packages from Canonical and upstream
• Review container runtime configurations to limit host kernel exposure