CVE-2022-24122: Linux Kernel Privilege Escalation Flaw

CVE-2022-24122 Overview

CVE-2022-24122 is a use-after-free vulnerability in kernel/ucount.c within the Linux kernel versions 5.14 through 5.16.4. The flaw exists when unprivileged user namespaces are enabled, allowing a ucounts object to outlive its associated namespace. An unprivileged local attacker can exploit this condition to escalate privileges on affected systems. The vulnerability is tracked under [CWE-416] (Use After Free) and affects multiple distributions including Fedora 34/35 and NetApp HCI compute and storage node firmware.

Critical Impact
Local attackers with unprivileged access can escalate to root privileges by exploiting a dangling ucounts reference after its parent user namespace is destroyed.

Affected Products

Linux kernel versions 5.14 through 5.16.4
Fedora Project Fedora 34 and 35
NetApp HCI H-series compute and storage nodes (H300S/H500S/H700S, H300E/H500E/H700E, H410S, H410C)

Discovery Timeline

2022-01-29 - CVE-2022-24122 published to NVD and disclosed publicly on the OpenWall OSS-Security mailing list
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24122

Vulnerability Analysis

The vulnerability resides in the ucounts subsystem, which tracks per-user resource accounting across user namespaces. Linux 5.14 introduced refactored ucounts handling that moved several rlimit counters (such as RLIMIT_NPROC, RLIMIT_MEMLOCK, RLIMIT_SIGPENDING, and RLIMIT_MSGQUEUE) into the struct ucounts object referenced by a user namespace.

A reference-counting flaw allows a ucounts object to remain reachable after its containing user namespace is freed. When the kernel later operates on the dangling object, it accesses freed memory, corrupting kernel heap state. Because user namespace creation is available to unprivileged users on systems where the feature is enabled, the attack surface includes any local user account.

Root Cause

The root cause is improper lifetime management between ucounts instances and their owning user namespace in kernel/ucount.c. The reference acquired by the rlimit accounting paths does not correctly pin the namespace, allowing the namespace to be released while a ucounts reference is still in use. The upstream fix in commit f9d87929d451d3e649699d0f1d74f71f77ad38f5 rebalances reference acquisition and release so the ucounts object cannot outlive its namespace.

Attack Vector

Exploitation requires local code execution as an unprivileged user on a kernel built with CONFIG_USER_NS=y and with kernel.unprivileged_userns_clone permitted. An attacker repeatedly creates user namespaces, manipulates rlimit-counted resources to force ucounts allocations, then triggers namespace teardown while retaining a reference. Reclaiming the freed slab object with attacker-controlled data permits kernel memory corruption and privilege escalation to root. The vulnerability cannot be exploited remotely and requires no user interaction beyond running a crafted local binary.

No public proof-of-concept code is referenced in the available advisories. See the Linux Kernel Commit and the OpenWall OSS-Security Discussion for upstream technical details.

Detection Methods for CVE-2022-24122

Indicators of Compromise

Unexpected kernel oops or general protection fault messages referencing ucounts, put_ucounts, or dec_ucount in dmesg or /var/log/messages.
KASAN or SLUB debug warnings reporting use-after-free in kernel/ucount.c on instrumented kernels.
Unprivileged processes acquiring elevated capabilities or uid=0 without a corresponding setuid execution chain in audit logs.

Detection Strategies

Inventory running kernel versions across Linux endpoints and flag any host running Linux 5.14 through 5.16.4 with CONFIG_USER_NS enabled.
Monitor auditd for unusual sequences of unshare(CLONE_NEWUSER) and clone() syscalls from non-root users, especially at high frequency.
Correlate kernel ring-buffer crashes with subsequent privilege transitions on the same host to surface exploitation attempts.

Monitoring Recommendations

Enable auditd rules for unshare, clone, and setns syscalls and forward events to a centralized log store for retention and analysis.
Track changes to /proc/sys/kernel/unprivileged_userns_clone and alert on any attempt to enable user namespaces on hosts where they are disabled.
Establish behavioral baselines for namespace-related syscall volume per user account to identify abnormal exploitation activity.

How to Mitigate CVE-2022-24122

Immediate Actions Required

Update affected Linux distributions to kernel builds that include upstream commit f9d87929d451d3e649699d0f1d74f71f77ad38f5 or later.
Apply Fedora updates referenced in the Fedora Package Announcement for Fedora 34 and 35.
For NetApp HCI deployments, follow remediation guidance in the NetApp Security Advisory.

Patch Information

The upstream fix is available in mainline commit f9d87929d451d3e649699d0f1d74f71f77ad38f5, merged into Linux 5.16.5. Distribution-specific backports were released by Fedora and incorporated into NetApp HCI element firmware updates. Reboot is required for the new kernel to take effect.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (RHEL/Fedora) until patches are applied.
Restrict local shell and code-execution access on multi-user systems to trusted administrators only.
Apply seccomp or SELinux/AppArmor profiles that block the unshare(CLONE_NEWUSER) syscall for non-essential workloads.

bash

# Configuration example - disable unprivileged user namespaces
# Runtime change
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0

# Persist across reboots
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2022-24122.conf
echo 'user.max_user_namespaces=0'        | sudo tee -a /etc/sysctl.d/99-cve-2022-24122.conf
sudo sysctl --system

# Verify
sysctl kernel.unprivileged_userns_clone user.max_user_namespaces