Linux kernel local privilege escalation (CVE-2022-0492) [PoC]
CVE-2022-0492
CVE-2022-0492: Linux kernel cgroups v1 flaw exploited in the wild - lets local attackers gain root privileges (CVSS 7.8). Patch your kernel now; check distro advisories.
Actively exploited in the wild - CVE-2022-0492 is a high-severity privilege escalation in the Linux kernel that lets a local attacker gain root access by abusing the cgroups v1 release_agent feature, bypassing namespace isolation.
Overview
CVE-2022-0492 is a vulnerability in the Linux kernel’s cgroup_release_agent_write function within kernel/cgroup/cgroup-v1.c. Under specific conditions, an attacker with low privileges can manipulate the cgroups v1 release_agent mechanism to execute arbitrary code as root. This effectively breaks the security boundaries provided by namespace isolation, a core Linux security feature.
The root cause is that the kernel does not properly validate whether a process has the necessary capabilities to set the release_agent path, allowing an unprivileged user to trigger code execution in the root namespace.
Impact
Successful exploitation of CVE-2022-0492 results in local privilege escalation (LPE) to root. An attacker who already has a foothold on the system - even with minimal privileges - can fully compromise the host. This is especially dangerous in containerized environments, where the vulnerability can allow a container escape.
The flaw has a CVSS score of 7.8 (High) with a low attack complexity and no user interaction required.
Remediation
The Linux kernel fix for CVE-2022-0492 is included in version 5.18-rc2 and has been backported to most stable kernel releases. All major Linux distributions have released patches.
Immediate actions:
- Update your kernel to the latest patched version from your distribution vendor.
- If you run containers, ensure the container runtime is configured to disable cgroups v1 or restrict the
release_agentfeature. - As a mitigation, add
cgroup_no_v1=net_prio,net_cls,hugetlb,memory,pids,rdma,miscto your kernel boot parameters to disable cgroups v1 entirely.
Security Insight
CVE-2022-0492 highlights a recurring pattern: legacy Linux kernel features (cgroups v1) often lack the hardening applied to their modern counterparts (cgroups v2). This vulnerability is reminiscent of the 2021 CVE-2021-22555, another cgroups flaw used for container escape. Both demonstrate that maintaining backward compatibility with older kernel subsystems carries real security debt. Organizations still running cgroups v1 should treat this as a strong signal to migrate to cgroups v2, which by default restricts release_agent functionality.
For more context on recent kernel threats, see:
- Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
- CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
- Nine CrackArmor Flaws in Linux AppArmor Enable Root
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Metasploit Modules
Weaponized exploit code — authorized use only
The Metasploit Framework modules below are production-ready exploit code maintained by Rapid7. Unlike random GitHub PoCs, these are vetted by Metasploit maintainers and integrated into a point-and-click exploitation framework used by red teams worldwide. The presence of an MSF module means this CVE is trivially exploitable at scale — patch immediately.
Authorized use only. Run only against systems you own or have explicit written permission to test. Using exploit code against systems you do not own is illegal in most jurisdictions and violates Yazoul's terms of use.
| Module | Source |
|---|---|
exploit/linux/local/docker_cgroup_escape | View source |
1 Metasploit module indexed for this CVE. Source: rapid7/metasploit-framework.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| PaloAltoNetworks/can-ctr-escape-cve-2022-0492 Test whether a container environment is vulnerable to container escapes via CVE-2022-0492 | ★ 47 |
| yoeelingBin/CVE-2022-0492-Container-Escape CVE-2022-0492-Container-Escape | ★ 2 |
| Trinadh465/device_renesas_kernel_AOSP10_r33_CVE-2022-0492 | ★ 0 |
| Perimora/cve_2022_0492 PoC for CVE-2022-0492 | ★ 0 |
Showing 4 of 4 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: H...
Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)...
Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)...
Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Hi...
Other Linux Kernel Vulnerabilities
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: H...
Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)...
Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)...
Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)...