NA

CVE-2022-2588

Published: 08/01/2024 Updated: 12/01/2024
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 0

Vulnerability Summary

It exists that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

canonical ubuntu linux 14.04

canonical ubuntu linux 20.04

canonical ubuntu linux 16.04

canonical ubuntu linux 18.04

canonical ubuntu linux 22.04

Vendor Advisories

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2022-2585 A use-after-free flaw in the implementation of POSIX CPU timers may result in denial of service or in local privilege escalation CVE-2022-2586 A use-after-free in the Netfilter ...
An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2021-33655) A vulnerability was found in the Linux kernel's ...
A use-after-free flaw was found in route4_change in the net/sched/cls_routec filter implementation in the Linux kernel This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issueA use-after-free flaw was found in route4_change in the net/sched/cls_routec filter implementation in the ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Several security issues were fixed in the Linux kernel ...
Synopsis Important: OpenShift Container Platform 41112 security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41112 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impac ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this upd ...
Synopsis Important: OpenShift Container Platform 41039 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41039 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 76 Advanced Update Support, Red Hat Enterprise Lin ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 82 Telecommunications Update ServiceRed Hat ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product Security has r ...
Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product Security ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 77 Advanced Update Support, Red Hat Enterprise Lin ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 77 Update Services for SAP SolutionsRed Hat Produ ...
Synopsis Important: kernel security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 74 Advanced Update SupportRed Hat Product Security has rated ...
Synopsis Moderate: Openshift Logging 5313 security and bug fix release Type/Severity Security Advisory: Moderate Topic An update is now available for OpenShift Logging 53Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed se ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 82 Advanced Mission Critical Update Support, Red H ...
Synopsis Moderate: Red Hat Advanced Cluster Management 248 security fixes and container updates Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 248 GeneralAvailability release images, which fix security issuesRed Hat Product Security has rated this update as having a security impactof Mo ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product S ...
Synopsis Important: kernel security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat P ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product Security has rated this ...
Synopsis Moderate: Logging Subsystem 554 - Red Hat OpenShift security update Type/Severity Security Advisory: Moderate Topic Logging Subsystem 554 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severi ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 82 Update Services for SAP SolutionsRed Hat Produ ...
Synopsis Important: OpenShift Container Platform 4951 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4951 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...
Synopsis Important: OpenShift Container Platform 4853 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4853 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this upd ...
Synopsis Important: Red Hat Virtualization security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for redhat-release-virtualization-host, redhat-virtualization-host, and redhat-virtualization-host-produ ...
Synopsis Important: OpenShift Virtualization 497 Images security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 497 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Important: kpatch-patch security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for kpatch-patch is now available for Red Hat Enterprise Linux 76 Update Services for SAP SolutionsRed Hat Produ ...
Synopsis Moderate: Red Hat Advanced Cluster Management 262 security update and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 262 GeneralAvailability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security i ...
A flaw was found in the Linux kernel The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV) (CVE-2022-0171) An out-of-bounds read flaw was found in the Linux kernel's TeleT ...
A use-after-free flaw was found in route4_change in the net/sched/cls_routec filter implementation in the Linux kernel This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem (CVE-2022-2588) ...
An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function This flaw allows a local user to crash the system or read unauthorized random data from memory ...
A use-after-free flaw was found in route4_change in the net/sched/cls_routec filter implementation in the Linux kernel This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem (CVE-2022-2588) ...
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures Internal memory locations could be returned to userspace A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel ...
A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679) A flaw was found in the Linux kernel's KVM when attempt ...
A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679) A flaw was found in the Linux kernel's KVM when attempt ...
An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2021-33655) A vulnerability was found in the Linux kernel's ...
A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679) A use-after-free flaw was found in the Linux kernel's P ...

Github Repositories

exploit for CVE-2022-2588

CVE-2022-2588 The fix The bug is fixed in Linux v519 by this commit The bug The bug was introduced in Linux v317 by this commit back to 2014 It requires User Namespaces to trigger This bug is very similar to CVE-2021-3715, which was caused by improper operation on the route4_filter's linked list More details of CVE-2021-3715 could be found at the blackhat talk (page

CVE-2022-2588 The fix The bug is fixed in Linux v519 by this commit The bug The bug was introduced in Linux v317 by this commit back to 2014 It requires User Namespaces to trigger This bug is very similar to CVE-2021-3715, which was caused by improper operation on the route4_filter's linked list More details of CVE-2021-3715 could be found at the blackhat talk (page

A PoC for CVE-2022-2588 that triggers a WARNING

CVE-2022-2588 - Linux kernel cls_route UAF It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0 Zhenpeng Lin working with Trend Micro's Zero Day Initiative discovered that this vulnerability could be exploited for Local Privilege Escalation This has

nmap sudo nmap -n -sS -sV -Pn -p- 192168108124 -min-rate 5000 Web Directory Scan Gobuster gobuster dir -u 192168108124:5357 -w /usr/share/wordlists/dirb/commontxt gobuster vhost -u thetoppershtb -w /usr/share/wordlists/wfuzz/general/commontxt --append-domain gobuster dns -d thetoppershtb -w /usr/share/wordlists/wf

Kernel exploitation technique

DirtyCred: Escalating Privilege in Linux Kernel DirtyCred is a kernel exploitation concept that swaps unprivileged kernel credentials with privileged ones to escalate privilege Instead of overwriting any critical data fields on kernel heap, DirtyCred abuses the heap memory reuse mechanism to get privileged Although the concept is simple, it is effective See the Blackhat p

CVE-2022-2588 Code adapted for one cpu, and with a vagrant file provided to boot up a vulnerable machine used for educational purposes To create a vulnerable machine, you need to have Vagrant installed on your machine, then execute on the repository root: Vagrant up Wait for installation and booting then : Vagrant ssh

A PoC for CVE-2022-2588 that triggers a WARNING

CVE-2022-2588 - Linux kernel cls_route UAF It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0 Zhenpeng Lin working with Trend Micro's Zero Day Initiative discovered that this vulnerability could be exploited for Local Privilege Escalation This has