Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2022‑32250) Threatens Cloud & On‑Prem Servers

Critical Local Privilege Escalation in Linux Kernel nf_tables (CVE‑2022‑32250) Threatens Cloud & On‑Prem Servers

What It Is – A use‑after‑free flaw in the Linux kernel’s nf_tables subsystem (CVE‑2022‑32250) allows a local attacker to gain root privileges by manipulating malformed nft_object structures.

Exploitability – The vulnerability is locally exploitable once an attacker can run low‑privileged code. Public PoCs have been released, and the CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates it as High severity.

Affected Products – All Linux distributions shipping kernel versions that include the vulnerable nf_tables implementation (e.g., Ubuntu, Debian, Red Hat, SUSE, etc.).

TPRM Impact –

• Third‑party SaaS and IaaS providers running unpatched Linux kernels may be compromised, exposing customer workloads.
• Supply‑chain risk: attackers can pivot from a compromised host to other services in the same environment, potentially affecting multiple downstream clients.

Recommended Actions –

• Verify kernel version on all Linux assets; apply the latest security patches (e.g., Ubuntu’s update for CVE‑2022‑32250).
• Enforce strict least‑privilege policies and limit execution of untrusted code on production systems.
• Deploy host‑based intrusion detection to monitor for abnormal nft operations.
• Update third‑party risk registers to reflect the new vulnerability and reassess vendor security posture.

Source: Zero Day Initiative Advisory – ZDI‑26‑191