CISA Warns: Linux Kernel Auth Fl Improper Authentication

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel vulnerability, CVE-2022-0492, to its Known Exploited Vulnerabilities (KEV) catalog. The agency warns this flaw is actively leveraged in real-world attacks.

The issue, categorized as improper authentication, affects Linux systems using the cgroups v1 release_agent feature and may allow attackers to achieve privilege escalation.

CVE-2022-0492 stems from insufficient validation and authentication controls within the Linux kernel’s control groups (cgroups) mechanism.

Specifically, the vulnerability enables a local attacker to manipulate the release_agent functionality, which is designed to execute a script when a cgroup becomes empty.

By exploiting this behavior, an attacker can execute arbitrary commands with elevated privileges, effectively escaping containerized environments or gaining root-level access on the host system.

Linux Kernel Improper Authentication Flaw Exploit

Security researchers have noted that this flaw is particularly dangerous in containerized and cloud-native environments where cgroups are widely used for resource isolation.

Misconfigured or unpatched systems may allow attackers who have already gained initial access, such as through a compromised container, to break out and take control of the underlying host.

This aligns with the broader trend of attackers targeting container escape vulnerabilities to move laterally within cloud infrastructure.

The vulnerability is associated with CWE-287 (Improper Authentication) and CWE-862 (Missing Authorization), highlighting inadequate checks for enforcing security boundaries.

While there is currently no confirmed public attribution linking CVE-2022-0492 directly to ransomware campaigns, CISA’s inclusion of the flaw in the KEV catalog indicates credible evidence of active exploitation in the wild.

CISA has mandated federal agencies to remediate the vulnerability by June 5, 2026, in accordance with Binding Operational Directive (BOD) 22-01.

The directive requires agencies to apply vendor-provided patches or mitigations to reduce exposure promptly.

Organizations that rely on affected Linux systems are strongly encouraged to follow similar timelines, as delays in patching could increase the risk of compromise.

Mitigation measures include updating the Linux kernel to a patched version that addresses the release_agent issue, turning off unprivileged user namespaces where feasible, and restricting access to cgroup configurations.

Security teams should also audit container environments and monitor for suspicious activity related to cgroup manipulation, as this may indicate attempted exploitation.

The addition of CVE-2022-0492 to the KEV catalog underscores the ongoing risk posed by privilege-escalation vulnerabilities in widely deployed open-source components.

As attackers increasingly target foundational technologies like the Linux kernel, timely patching and proactive monitoring remain essential to defending enterprise and cloud environments against evolving threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.