CVE-2022-32250: Linux Kernel Privilege Escalation Flaw

CVE-2022-32250 Overview

CVE-2022-32250 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Netfilter subsystem, specifically in net/netfilter/nf_tables_api.c. The flaw affects Linux kernel versions through 5.18.1 and stems from an incorrect NFT_STATEFUL_EXPR check during set element handling. A local user with the ability to create user and network namespaces can trigger the use-after-free condition to escalate privileges to root. The vulnerability is exploitable on default configurations of major distributions including Debian, Fedora, and others that enable unprivileged user namespaces. A public proof-of-concept exploit was published by Theori, demonstrating reliable local privilege escalation.

Critical Impact
Local attackers can escalate to root on unpatched Linux systems where unprivileged user namespaces are enabled.

Affected Products

Linux kernel through 5.18.1
Debian Linux 9.0, 10.0, and 11 (bullseye)
Fedora 35 and 36
NetApp HCI products: H300S, H500S, H700S, H410S, H410C (firmware)

Discovery Timeline

2022-05-31 - Initial disclosure on the Openwall oss-security mailing list
2022-06-02 - CVE-2022-32250 published to NVD
2022-06-03 - Follow-up oss-security post with additional analysis
2022-07-15 - NetApp publishes security advisory NTAP-20220715-0005
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-32250

Vulnerability Analysis

The vulnerability resides in the nf_tables subsystem, which provides the in-kernel implementation for nftables packet filtering. When processing NFT_MSG_NEWSET requests, the kernel must correctly identify stateful expressions associated with set elements. An incorrect check for NFT_STATEFUL_EXPR causes the kernel to free an expression object while a dangling reference remains accessible through the set's expression list. Subsequent operations dereference the freed memory, producing a classic use-after-free condition on a kernel heap object.

Because nftables configuration requires CAP_NET_ADMIN, exploitation depends on the attacker obtaining that capability inside an unprivileged user namespace. On distributions where kernel.unprivileged_userns_clone=1 (the default on Debian, Ubuntu, and Fedora), any local user can create such a namespace.

Root Cause

The root cause is a missing or incorrect validation of the expression type in the nft_set_elem_expr_alloc() code path. The function fails to distinguish stateful from non-stateful expressions, leading to premature release of the expression structure while still referenced by the set descriptor. The upstream fix is contained in commit 520778042ccca019f3ffa136dd0ca565c486cedd, which corrects the expression type check before deallocation.

Attack Vector

Exploitation requires local access and the ability to invoke the nftables Netlink interface. The attacker creates a user namespace, gains CAP_NET_ADMIN within it, and issues crafted Netlink messages to allocate and free nft_expr objects in a controlled sequence. By reclaiming the freed slab object with attacker-controlled data — typically using msg_msg or similar primitives — the attacker corrupts kernel structures to achieve arbitrary read/write and ultimately overwrite credentials or modprobe_path to obtain root. Theori published a working exploit demonstrating this technique. See the Theori CVE-2022-32250 Analysis and the Theori exploit repository for full technical details.

Detection Methods for CVE-2022-32250

Indicators of Compromise

Unexpected processes invoking unshare() or clone() with CLONE_NEWUSER and CLONE_NEWNET flags by non-administrative users
Anomalous Netlink traffic over NETLINK_NETFILTER from unprivileged user contexts
Kernel oops, BUG: KASAN: use-after-free, or general protection fault messages referencing nft_ symbols in dmesg
Sudden UID transitions to 0 from processes that did not invoke setuid binaries

Detection Strategies

Monitor execve audit events for tools such as nft, iptables-nft, and custom binaries issuing Netlink configuration
Use Linux audit rules to record unshare, setns, and clone syscalls with namespace-related flags
Inspect kernel ring buffer logs for KASAN reports or slab corruption messages tied to nf_tables
Correlate process lineage to identify privilege transitions following user-namespace creation

Monitoring Recommendations

Enable auditd rules covering nf_tables Netlink operations and namespace syscalls on production Linux hosts
Forward kernel logs to a centralized logging or SIEM platform for retrospective analysis
Alert on any non-root process that successfully writes to /proc/sys/kernel/modprobe or executes shells with EUID 0 outside expected administrative workflows

How to Mitigate CVE-2022-32250

Immediate Actions Required

Apply vendor kernel updates from the Debian DSA-5161, Debian DSA-5173, Fedora, and NetApp NTAP-20220715-0005 advisories
Reboot affected hosts after kernel package installation to load the patched image
Inventory all Linux systems running kernel versions at or below 5.18.1 and prioritize internet-facing and multi-tenant hosts

Patch Information

The upstream fix is provided in Linux kernel commit 520778042ccc. Distribution-specific fixes are available in Debian via DSA-5161 and DSA-5173, in Fedora via the Fedora package announcement updates, and for NetApp HCI products through advisory NTAP-20220715-0005. Red Hat tracking is available in Bugzilla entry 2092427.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (Fedora/RHEL) where workloads do not require them
Restrict access to the nf_tables subsystem by blocking loading of the nf_tables kernel module on systems that do not use nftables
Apply seccomp or SELinux policies that prevent unprivileged processes from invoking unshare(CLONE_NEWUSER)

bash

# Disable unprivileged user namespaces (Debian/Ubuntu)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-disable-userns.conf
sudo sysctl --system

# Disable unprivileged user namespaces (Fedora/RHEL)
echo 'user.max_user_namespaces=0' | sudo tee /etc/sysctl.d/99-disable-userns.conf
sudo sysctl --system

# Blacklist nf_tables module if unused
echo 'install nf_tables /bin/true' | sudo tee /etc/modprobe.d/disable-nftables.conf