New Linux Vulnerability CVE-2022-0492 Affecting Cgroups: Can Containers Escape?
Summary: On Feb. 4, Linux announced CVE-2022-0492, a privilege escalation vulnerability in the kernel's cgroup v1 feature, caused by a missing check that the process writing the release_agent file holds CAP_SYS_ADMIN. Unit 42 reports that default hardenings in most container environments prevent escape, but containers running without Seccomp and without AppArmor or SELinux can mount a writable cgroupfs via user namespaces and set a release agent that runs with full root permissions.
Why it matters: This is the third kernel vulnerability in recent months that lets malicious containers escape, and in all three, Seccomp plus AppArmor or SELinux was enough to stop it - so any container running without those controls is the exposure to find.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-0492
- Related
- CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability Known Exploited Vulnerabilities · Jun 02, 2026Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026