CVE-2022-42432

What it actually does

The nft_osf_eval function in the Linux kernel fails to initialize memory before access, resulting in disclosure of sensitive kernel memory contents to a local high-privileged attacker.

Why it matters to the business

Attackers with existing elevated access can read kernel memory, enabling further compromise such as privilege escalation or data theft on affected Linux systems; the long-unpatched window increases exposure across servers and devices using this kernel version.

How an attack unfolds

An attacker first gains high-privileged code execution on the target, then triggers the uninitialized memory access in nft_osf_eval to leak sensitive data; this information can be combined with additional vulnerabilities to achieve kernel-level arbitrary code execution.

How to fix it

Upgrade the Linux kernel to a version containing the fix for this memory initialization issue; apply vendor-supplied patches as they become available and rebuild any custom kernels with the correction.

How to confirm the fix worked

Confirm the installed kernel version is newer than 6.0-rc2 and contains the nft_osf_eval memory initialization fix; review kernel source or changelog entries referencing ZDI-CAN-18540 or the nft_osf_eval function.

Typical attack path

1. Obtain high-privileged local code execution on the target system
2. Invoke nft_osf_eval with crafted parameters to trigger uninitialized memory read
3. Exfiltrate disclosed kernel memory contents
4. Leverage leaked data in conjunction with other exploits to escalate to kernel code execution

How to detect it

Search kernel logs and audit trails for unexpected nft_osf_eval invocations or memory access patterns from high-privileged processes; examine process execution history and any evidence of memory-leak artifacts or chained exploit attempts by known kernel-focused threat actors.

What your security team should do

• Prioritize kernel upgrades on all systems running version 6.0-rc2 or nearby development releases
• Audit systems for the presence of high-privileged local access paths that could be abused as a prerequisite
• Monitor for chained exploitation attempts combining information disclosure with other kernel vulnerabilities
• Enforce least-privilege principles to reduce the likelihood of obtaining the required initial high-privileged execution