Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2022‑32250) Threatens Cloud & On‑Prem Servers

Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2022‑32250) Threatens Cloud & On‑Prem Servers

What It Is – A use‑after‑free flaw in the Linux kernel’s nf_tables subsystem (CVE‑2022‑32250) allows a local attacker to gain root privileges by manipulating malformed nft_object structures.

Exploitability – The vulnerability is locally exploitable once an attacker can run low‑privileged code. Public PoCs have been released, and the CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates it as High severity.

Affected Products – All Linux distributions shipping kernel versions that include the vulnerable nf_tables implementation (e.g., Ubuntu, Debian, Red Hat, SUSE, etc.).

TPRM Impact –

• Third‑party SaaS and IaaS providers running unpatched Linux kernels may be compromised, exposing customer workloads.
• Supply‑chain risk: attackers can pivot from a compromised host to other services in the same environment, potentially affecting multiple downstream clients.

Recommended Actions –

1. Verify kernel version on all Linux assets; apply the latest security patches (e.g., Ubuntu’s update for CVE‑2022‑32250).
2. Enforce strict least‑privilege policies and limit execution of untrusted code on production systems.
3. Deploy host‑based intrusion detection to monitor for abnormal nft operations.
4. Update third‑party risk registers to reflect the new vulnerability and reassess vendor security posture.

Source: Zero Day Initiative Advisory – ZDI‑26‑191