CVE-2022-2586

What is Linux nf_tables?

nf_tables is the kernel subsystem that implements modern Linux firewall and packet filtering rules, replacing the older iptables. It runs in the kernel and manages network filtering objects including chains, tables, rules, and named objects. Because nf_tables handles complex rule processing in privileged kernel space, bugs in its object lifecycle management can expose use-after-free primitives exploitable for local privilege escalation.

Overview

CVE-2022-2586 is a use-after-free vulnerability (CWE-416) in the nf_tables component of the Linux kernel. A local low-privilege user can trigger the vulnerability by manipulating nft_object lifecycle operations — specifically exploiting the case where an object bound to a chain can be freed while a reference remains active. Successful exploitation can lead to privilege escalation to root. CISA added this to KEV in June 2024, two years after the original disclosure, reflecting confirmed exploitation in targeted attack chains.

Affected Versions

Technical Details

The vulnerability involves nft_object handling in net/netfilter/nf_tables_api.c. When an nf_tables object is bound to a chain, the reference counting does not properly account for the binding, creating a use-after-free condition:

• Root cause: An nft_object that has been bound to a chain does not receive a reference count increment; subsequent operations can free the object while the chain still references it
• Exploitation: A local attacker creates and manipulates nf_tables objects to trigger the UAF, using the freed memory as a type confusion or heap spray primitive for kernel code execution
• Attack vector: Local — requires the ability to call nft_* syscalls (available to normal users on most Linux distros unless restricted by seccomp/AppArmor)
• Impact: Local privilege escalation to root

Discovery

Reported by Moshe Kol and Shlomi Oberman, disclosed to the oss-security mailing list in August 2022.

Exploitation Context

The two-year gap between oss-security disclosure (2022) and CISA KEV addition (2024) suggests exploitation was confirmed in targeted Android or Linux LPE chains used by sophisticated actors. nf_tables vulnerabilities have been a consistent source of Android privilege escalation exploits, with the same subsystem yielding multiple KEV entries (CVE-2023-32233, CVE-2023-35829, etc.).

Remediation

1. Apply the latest Linux kernel security updates from your distribution's security repositories
2. For Android devices: apply manufacturer security patches for your device model
3. On desktop/server Linux, restrict nf_tables access with AppArmor or seccomp profiles where possible
4. Consider enabling kernel.unprivileged_userns_clone=0 on systems that do not require unprivileged user namespaces, which can limit the exploitability of nf_tables bugs