CVE-2022-0330: Linux Kernel i915 Privilege Escalation

CVE-2022-0330 Overview

CVE-2022-0330 is a random memory access flaw in the Linux kernel's i915 Intel graphics driver. The vulnerability resides in the GPU driver path that allows a user to submit code for execution on the GPU. A local authenticated attacker can abuse this flaw to access arbitrary kernel memory, crash the system, or escalate privileges to root. The issue affects mainline Linux kernels prior to the upstream fix and shipped in multiple Red Hat Enterprise Linux, Fedora, and NetApp HCI products. The flaw is tracked under CWE-281: Improper Preservation of Permissions.

Critical Impact
A local user with access to the i915 DRM device can trigger arbitrary kernel memory access, leading to system crash or full root privilege escalation.

Affected Products

Linux kernel (versions prior to upstream fix, including 5.17-rc1)
Red Hat Enterprise Linux 7, 8, and related Extended Update Support, AUS, and TUS variants
Fedora 34 and 35, Red Hat Virtualization, oVirt-node 4.4.10, and NetApp HCI H-series compute and storage nodes

Discovery Timeline

2022-03-25 - CVE-2022-0330 published to the National Vulnerability Database
2022-05-26 - NetApp publishes downstream security advisory for affected HCI products
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0330

Vulnerability Analysis

The i915 driver provides kernel support for Intel integrated GPUs and manages the GPU's Memory Management Unit (MMU) through Translation Lookaside Buffer (TLB) entries. The driver did not consistently invalidate GPU TLB entries when memory backing a GPU object was released or reassigned. As a result, the GPU could continue to access physical memory pages that the kernel had since reallocated to unrelated kernel structures or other user processes.

A local user with permission to submit GPU workloads can leverage this stale mapping to read or write arbitrary kernel memory from GPU context. This produces three distinct outcomes: information disclosure of kernel data, corruption of kernel structures leading to a system crash, or targeted overwrite of credentials and function pointers to gain root privileges.

Root Cause

The defect is classified as CWE-281: Improper Preservation of Permissions. The driver failed to flush GPU-side TLB entries before freeing or repurposing the backing pages of a GPU buffer object. Because the GPU continues to honor cached translations, the original physical pages remain reachable from the GPU even after the kernel has handed them back to the page allocator.

Attack Vector

Exploitation requires local access and the ability to open the i915 DRM device node (typically /dev/dri/card0 or /dev/dri/renderD128), which is available to members of the video or render group on most distributions. The attacker allocates a GPU buffer object, retains a reference through the GPU command stream, then triggers a free path on the kernel side. By racing further allocations, the freed physical pages are reused by sensitive kernel structures while the GPU still holds a valid TLB entry. The attacker then issues GPU commands to read or write those pages, achieving kernel memory disclosure or modification without invoking standard kernel syscalls for that memory. No user interaction is required and the scope remains unchanged.

No public proof-of-concept is referenced in the enriched data. See the Red Hat Bugzilla report and the OpenWall OSS Security post for upstream discussion.

Detection Methods for CVE-2022-0330

Indicators of Compromise

Unexpected kernel oops or GPF traces referencing i915_gem, i915_vma, or intel_gt functions in dmesg and /var/log/kern.log
Local processes with the render or video group performing unusual ioctl calls against /dev/dri/card* or /dev/dri/renderD* followed by privilege transitions
Unexplained UID transitions to 0 from processes that previously held only graphics device access

Detection Strategies

Audit kernel version on every Linux host and flag systems running i915-enabled kernels older than the fixed release noted in the Red Hat advisory
Enable auditd rules on /dev/dri/* device access and correlate with subsequent execve calls running as root
Monitor for repeated GPU buffer object allocation and free patterns from a single non-privileged process, which can indicate a TLB-reuse race

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized SIEM and alert on i915 driver fault signatures
Track loaded kernel module versions across the fleet and compare against vendor-fixed builds from Red Hat, Fedora, and NetApp
Watch for child processes spawned by graphics-capable services that transition to UID 0 without an intervening sudo or su event

How to Mitigate CVE-2022-0330

Immediate Actions Required

Apply the kernel update from your distribution vendor: Red Hat, Fedora, and NetApp have all released fixed builds tracked in the NetApp advisory NTAP-20220526-0001
Reboot affected systems after the kernel package update so the patched i915 driver is loaded
Inventory systems that expose /dev/dri/* to interactive users or container workloads and prioritize those for patching

Patch Information

The upstream fix adds explicit GPU TLB invalidation before releasing pages backing GPU objects in the i915 driver. Distribution updates are tracked in the Red Hat Bugzilla report 2042404 and the OpenWall OSS Security follow-up. Administrators should install the kernel package version specified in their distribution's security advisory and reboot.

Workarounds

Where patching is not immediately possible, restrict membership of the video and render groups to trusted users only
Blacklist the i915 kernel module on servers that do not require Intel GPU functionality by adding blacklist i915 to /etc/modprobe.d/ and rebuilding the initramfs
Prevent unprivileged containers from mounting /dev/dri by enforcing device cgroup restrictions in container runtime policies

bash

# Verify kernel version and i915 module status
uname -r
lsmod | grep i915

# Disable i915 on systems that do not need it
echo 'blacklist i915' | sudo tee /etc/modprobe.d/blacklist-i915.conf
sudo dracut -f

# Restrict DRI device access to a dedicated group
sudo chgrp render /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128