CVE-2022-2586
Published: 08 January 2024
Summary
CVE-2022-2586 is a medium-severity Use After Free (CWE-416) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 13.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. This vulnerability affects the nftables subsystem in the Linux kernel and is tracked as CWE-416 with a CVSS score of 5.3.
A local attacker with low privileges can exploit the flaw by crafting nftables configurations that cross table boundaries, resulting in memory corruption that may enable limited integrity impact or denial of service through a crash.
Ubuntu security notices USN-5557-1, USN-5560-1, and USN-5560-2, along with the upstream kernel patch posted to the netfilter-devel list, address the issue through updated kernel packages that prevent cross-table references in nft objects and expressions.
The associated EPSS score remains low with only minor fluctuation between its current value of 0.0275 and recorded peak of 0.0447.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34835
Vulnerability details
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
- CWE(s)
- KEV Date Added
- 26 June 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the kernel patch that eliminates cross-table nft set references, closing the use-after-free in nftables.
Enforces the nftables reference rules (same-table only) that the fix implements, blocking the dangling-pointer condition at the point of rule creation.
Restricts which local users or processes are permitted to create or modify nftables objects, reducing the population that can trigger the cross-table reference flaw.