The Linux kernel before 5.17.2 mishandles seccomp permissions.
Priority LOW 35CWE-862Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 12 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-862.
Summary
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
Why it matters now
EPSS 0.00798 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 12 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | before 4.19.238; 4.20 to before 5.4.189; 5.5.0 to before 5.10.110; 5.11 to before 5.15.33; 5.16.0 to before 5.16.19; 5.17 to before 5.17.2 | Vulnerable | Linux |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 4.19.238; 4.20 to before 5.4.189; 5.5.0 to before 5.10.110; 5.11 to before 5.15.33; 5.16.0 to before 5.16.19; 5.17 to before 5.17.2 Vulnerable ·Linux
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 7 advisories
- RHSA-2024:0412 Released 2024-01-25 · Red Hat rating Importantkernel security and bug fix update
- Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-tools-libs-devel-4.18.0-372.87.1.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) bpftool-4.18.0-372.87.1.el8_6, kernel-4.18.0-372.87.1.el8_6, kernel-abi-stablelists-4.18.0-372.87.1.el8_6 +19
- Red Hat Virtualization 4 Hypervisor for RHEL 8 kernel-devel-4.18.0-372.87.1.el8_6, perf-4.18.0-372.87.1.el8_6
- RHSA-2023:2951 Released 2023-05-16 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-477.10.1.el8_8, kernel-4.18.0-477.10.1.el8_8, kernel-abi-stablelists-4.18.0-477.10.1.el8_8 +19
- Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-477.10.1.el8_8
- RHSA-2023:2736 Released 2023-05-16 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core-4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-4.18.0-477.10.1.rt7.274.el8_8 +9
- Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core-4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-4.18.0-477.10.1.rt7.274.el8_8 +7
Show 4 more Red Hat advisories
- RHSA-2023:0300 Released 2023-01-23 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-core-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-debug-5.14.0-162.12.1.rt21.175.el9_1 +7
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-core-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-debug-5.14.0-162.12.1.rt21.175.el9_1 +9
- RHSA-2023:0334 Released 2023-01-23 · Red Hat rating Importantkernel security and bug fix update
- Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-162.12.1.el9_1
- Red Hat Enterprise Linux AppStream (v. 9) kernel-debug-devel-5.14.0-162.12.1.el9_1, kernel-debug-devel-matched-5.14.0-162.12.1.el9_1, kernel-devel-5.14.0-162.12.1.el9_1 +5
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-5.14.0-162.12.1.el9_1, kernel-5.14.0-162.12.1.el9_1, kernel-abi-stablelists-5.14.0-162.12.1.el9_1 +14
- RHSA-2022:7318 Released 2022-11-02 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-70.30.1.el9_0
- Red Hat Enterprise Linux AppStream (v. 9) kernel-debug-devel-5.14.0-70.30.1.el9_0, kernel-debug-devel-matched-5.14.0-70.30.1.el9_0, kernel-devel-5.14.0-70.30.1.el9_0 +5
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-5.14.0-70.30.1.el9_0, kernel-5.14.0-70.30.1.el9_0, kernel-abi-stablelists-5.14.0-70.30.1.el9_0 +14
- RHSA-2022:7319 Released 2022-11-02 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-70.30.1.rt21.102.el9_0, kernel-rt-core-5.14.0-70.30.1.rt21.102.el9_0, kernel-rt-debug-5.14.0-70.30.1.rt21.102.el9_0 +7
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-70.30.1.rt21.102.el9_0, kernel-rt-core-5.14.0-70.30.1.rt21.102.el9_0, kernel-rt-debug-5.14.0-70.30.1.rt21.102.el9_0 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2022:7318, RHSA-2023:0334 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2024:0412 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7318, RHSA-2023:0334 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:2951 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:7318, RHSA-2023:0334 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0412 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:2951 |
| Red Hat Enterprise Linux NFV (v. 8) | Fixed | RHSA-2023:2736 |
| Red Hat Enterprise Linux RT (v. 8) | Fixed | RHSA-2023:2736 |
| Red Hat Enterprise Linux Real Time (v. 9) | Fixed | RHSA-2022:7319, RHSA-2023:0300 |
| Red Hat Enterprise Linux Real Time for NFV (v. 9) | Fixed | RHSA-2022:7319, RHSA-2023:0300 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2024:0412 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30594
- 2026-10-03 Alias added: GHSA-c23x-r777-vmjw
References
Patch 3
Advisory 5
- http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update
- DSA-5173
- https://security.netapp.com/advisory/ntap-20220707-0001/
- http://packetstormsecurity.com/files/170362/Linux-PT_SUSPEND_SECCOMP-Permission-Bypass-Ptracer-Death-Race.html
Sources
- CVE-2022-30594 · CVE Program
- CVE-2022-30594 · NVD
- FIRST EPSS
- GHSA-c23x-r777-vmjw · GitHub Advisory Database · CC BY 4.0
- CVE-2022-30594 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences