CVE-2022-34918

What it actually does

Type confusion in nft_set_elem_init triggers a buffer overflow in the Linux kernel netfilter subsystem, allowing local privilege escalation to root when CAP_NET_ADMIN is obtained via an unprivileged user namespace.

Why it matters to the business

Local attackers can obtain full root access on affected Linux systems, enabling data theft, persistence, or lateral movement; weaponized exploits increase risk on high-prevalence kernel deployments despite low EPSS and no ransomware usage.

How an attack unfolds

An attacker starts by creating an unprivileged user namespace to gain CAP_NET_ADMIN, then supplies crafted nftables set elements that trigger the type confusion in nft_set_elem_init, resulting in a buffer overflow that overwrites kernel memory to escalate to root; public weaponized exploits facilitate this path on unpatched kernels.

How to fix it

Upgrade the Linux kernel to a version containing the fix in nft_setelem_parse_data within net/netfilter/nf_tables_api.c; apply vendor-specific kernel packages for distributions such as Debian and Ubuntu, and update NetApp firmware where applicable.

How to confirm the fix worked

Verify the running kernel version exceeds 5.18.9 and confirm the presence of the nft_setelem_parse_data patch; test nftables operations under a user namespace to ensure no overflow occurs.

Typical attack path

1. Create an unprivileged user namespace
2. Obtain CAP_NET_ADMIN capability
3. Craft malicious nftables set elements
4. Invoke nft_set_elem_init to trigger type confusion and buffer overflow
5. Overwrite kernel structures to gain root privileges

How to detect it

Review kernel logs for netfilter buffer overflow indicators, monitor nftables API calls from user namespaces, and inspect for post-exploitation artifacts such as unexpected root processes or capability changes; correlate with threat actor activity targeting Linux kernel flaws.

What your security team should do

• Apply kernel updates immediately on all Linux systems given weaponized exploit maturity
• Restrict unprivileged user namespace creation via kernel parameters where feasible
• Monitor kernel logs for netfilter-related crashes or anomalies
• Audit nftables usage for unexpected configurations