Linux Kernel cgroups v1 Container Escape and Privilege Escalation Vulnerability (CVE-2022-0492)

1. Kernel Patch Installation

The most effective remediation is upgrading the Linux kernel to a patched version.

# For Ubuntu / Debian systems
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic

# For RHEL / CentOS / Rocky Linux systems
sudo dnf update kernel

2. Temporary Mitigations

If immediate kernel updates are not feasible, apply the following security configurations to reduce the attack surface:

• Run Non-root Containers: Ensure container processes do not run as the root user.
• Enable Seccomp Profiles: Default Seccomp profiles in Docker and Kubernetes block unshare and clone system calls, preventing the creation of new user namespaces inside containers.
• Enforce AppArmor / SELinux: Restrict containers from mounting /sys/fs/cgroup with write permissions.
• Mount cgroup as Read-Only: Run containers with read-only cgroup mounts.

  docker run --read-only ...

This vulnerability (CVE-2022-0492) is a privilege verification bypass (CWE-287, CWE-862) residing in the cgroup_release_agent_write function within kernel/cgroup/cgroup-v1.c of the Linux kernel.

The release_agent feature in cgroups v1 allows the kernel to execute a user-defined binary (agent) when all processes in a control group terminate. This agent runs with full root privileges on the host system.

Under normal conditions, only processes with administrative privileges should be allowed to modify the release_agent path. However, in vulnerable kernel versions, insufficient permission checks allow processes inside a container to modify the release_agent file. An attacker can write a malicious script path to release_agent and trigger the cgroup release, forcing the host kernel to execute the script with host root privileges, resulting in a complete container escape.

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and has an EPSS score of 0.94, indicating active exploitation in the wild.