The US cybersecurity agency CISA on Tuesday warned of in-the-wild exploitation of a Linux kernel vulnerability that leads to container escapes.
Tracked as CVE-2022-0492 (CVSS score of 7.8), the issue is described as an improper authentication vulnerability that could allow attackers to elevate their privileges and bypass the namespace isolation.
The security defect was found in cgroups, the Linux kernel’s control groups feature that specifies which OS resources a group of processes can use. While there are two control group versions, only cgroups v1 is affected.
Together with namespaces, cgroups can be used for process isolation and to restrict access to certain resources, which makes the feature essential for container creation.
Due to the vulnerability, any user could modify the release_agent file residing at the root of the cgroup hierarchy, which runs as root within the cgroup namespace as part of cgroup v1’s notification mechanism when a cgroup becomes empty.
“It is then possible to create a malicious script that is located on the host filesystem that will be run as root as part of the cgroup notification process, essentially allowing for a container escape and privilege escalation,” HackTheBox explains.
Additionally, the bug allowed attackers to create a new user namespace with admin privileges and then create a cgroup with a malicious release_agent file, triggering the exploit.
Technical details on CVE-2022-0492 were published roughly three years ago, but its in-the-wild exploitation was reported only this week, one day before CISA’s alert.
Kaspersky mentioned the exploitation of CVE-2022-0492 in a blog post describing attacks on container environments, but has not specified who is behind the attacks, nor who the victims are.
On Tuesday, the cybersecurity agency added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by June 5.
CISA also urged the immediate patching of CVE-2025-48595, a high-severity flaw in Android’s Framework component. Google patched the issue this week, warning that it has been exploited as a zero-day.
Related: ‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds
Related: Oracle WebLogic Vulnerability Exploited in the Wild
Related: WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites
Related: Recent Palo Alto Networks Vulnerability Exploited for Weeks
