External risk intelligence

Linux Kernel Watch Queue Out-of-Bounds Write Vulnerability.

CVE advisoryKnown Exploit

CVE-2022-0995

This vulnerability is located within the Linux kernel's internal event notification subsystem. Exploitation requires local access to the system to interact with the kernel, making it inherently local and not reachable via public network services.

Out-of-bounds Write

Linux Kernel

5.8 to before 5.10.1065.11 to before 5.15.295.16 to before 5.16.55.1735

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's event notification system that could allow a local user to elevate their privileges or disrupt system operations. This technical flaw involves an out-of-bounds memory write, meaning data could be written to an unintended location within the system's memory, potentially corrupting critical kernel information.

Local users may gain elevated system access.
Confirms an internal technical vulnerability exists.
Assess relevance and exposure to your Linux systems.

Attack Path

How an attacker could exploit the issue

An attacker with local access to a Linux system could exploit a memory write flaw in the kernel's event notification subsystem. This vulnerability, triggered by a specific interaction with the `watch_queue` feature, allows an attacker to corrupt kernel memory. Successful exploitation could grant the attacker elevated privileges or cause the system to crash.

Requires local user access.
Triggered by interacting with `watch_queue`.
Risk of privilege escalation or denial of service.

Live Threat

Current exploitation, exposure, and threat context

A local user could potentially overwrite critical kernel memory, impacting system stability and security. This may allow for unauthorized privileged access or a denial-of-service condition when the watch_queue subsystem is actively used.

Kernel memory and state.
Local user writes out-of-bounds.
Privileged access or DoS.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts systems running specific versions of the Linux kernel. Infrastructure or platform teams are likely responsible for kernel maintenance, while application owners must coordinate with them to ensure their services are not disrupted. The immediate first step is to inventory all systems utilizing the affected kernel, determine their criticality and exposure, and then engage the appropriate teams for remediation planning.

Ownership: Infrastructure and platform teams.
Verify first: System inventory and exposure.
Action: Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel watch_queue subsystem?

The watch_queue subsystem is a feature within the Linux kernel that allows programs to receive notifications about specific events occurring in the kernel. It is a communication mechanism designed to streamline how applications track system activity, such as key retention or device changes, rather than relying on constant polling.

What does CWE-787 mean for CVE-2022-0995?

CWE-787 refers to an out-of-bounds write vulnerability. In the context of this CVE, it means the kernel's watch_queue feature fails to properly check the boundaries of memory before writing data to it. This allows an attacker to write information into parts of the system's memory that they should not be able to access, potentially corrupting critical kernel data structures.

How is CVE-2022-0995 triggered by an attacker?

An attacker must already have local access to the system to trigger this vulnerability by interacting with the watch_queue subsystem. It cannot be triggered remotely or through a network service. If a user does not have an account on the machine or the ability to run code locally, they cannot initiate the specific sequence of operations required to exploit this flaw.

Why does Halo Surface Signal classify this as internal?

Halo Surface Signal labels this as internal because the vulnerability exists deep within the kernel's local event notification logic. Since exploitation requires local system access, the bug is not reachable via public-facing internet services. This means that having an internet-facing server does not change the attack surface for this specific issue, as the attacker still needs to be present on the local machine first.

What should I do if I run an affected Linux kernel?

Your first step is to inventory your systems to identify which machines are running the vulnerable kernel versions. Since this requires local access, prioritize systems where untrusted users might have login permissions. Work with your infrastructure or platform teams to schedule kernel updates, as these patches typically require a system reboot to take full effect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.