CVE-2022-23222

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-23222 has a selected CVSS score of 7.8 (high); EIP currently links 4 repository PoCs and 1 lab environment.

Description

kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
4
Lab environments
1

Proofs of concept

4

Repository PoCs

GitHubtr3ee/CVE-2022-23222Repository PoCby tr3ee575Not analyzed7 files

60.5 KiB

GitHub
PoC details
GitHubPenteraIO/CVE-2022-23222-POCRepository PoCby PenteraIO6Not analyzed6 files

25.3 KiB

GitHub
PoC details
GitHubFridayOrtiz/CVE-2022-23222Repository PoCby FridayOrtiz1Not analyzed15 files

90.5 KiB

GitHub
PoC details
GitHubLeoMarche/ProjetSecuRepository PoCby LeoMarche0Not analyzed4 files

191.7 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

FridayOrtiz/CVE-2022-23222Created Vuln labCVE-2022-23222Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based build environment for compiling a Rust exploit targeting CVE-2022-23222, a Linux kernel eBPF verifier vulnerability. The Dockerfile creates an Ubuntu 20.04 container with Rust installed, and the build script mounts the project directory to compile the exploit binary. A separate Vagrant lab is described for testing the exploit on a vulnerable kernel.

Dockerfile:1-12build.sh:1-4README.md:1-678

Lab assessment

Vulnerability lab

The repository explicitly documents CVE-2022-23222, provides exploit source code, a Dockerfile for building the exploit, and a Vagrant lab for testing on a vulnerable kernel. The README details the vulnerability, exploitation steps, and references the original CVE writeup.

README.md:1-3README.md:5-7README.md:660-678
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

build environment

Defines an Ubuntu 20.04 image with build-essential, curl, and Rust installed. Sets WORKDIR to /data. Used to compile the exploit binary.

Dockerfile:1-12

build.sh

build script

Builds the Docker image and runs a container that mounts the current directory to /data and executes 'cargo build --release' to compile the exploit.

build.sh:1-4

exploit.c

exploit source

C source code implementing the CVE-2022-23222 exploit. Contains functions to create BPF maps, leak kernel addresses, set up arbitrary read/write, find and overwrite process credentials, and spawn a root shell.

src/exploit/exploit.c:1-507

Cargo.toml / Cargo.lock

Rust project manifestdependency specification

Defines the Rust project 'cve_2022_23222' with dependencies on nix, cc, and libc. The lock file pins exact dependency versions.

Cargo.toml:1-23Cargo.lock:1-63

Vagrant lab (lab/Vagrantfile)

test environment

A Vagrant configuration (referenced in README) that provisions a vulnerable Ubuntu VM, copies the exploit, and allows testing. Not included in the evidence files but described in the README.

README.md:660-678
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-23222

Supported by supplied evidence

The README explicitly states the repository is for CVE-2022-23222, describes the vulnerability in the Linux kernel eBPF verifier, and provides exploit code that leverages the described pointer type mismatch. The exploit targets the specific kernel versions and behavior documented in the CVE.

README.md:1-3README.md:5-7README.md:8-12src/exploit/exploit.c:1-507
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker installed and permissioned for the user to build the exploit binary.README.md:660-662
  • A vulnerable Linux kernel (5.8 through unpatched versions) with unprivileged BPF enabled (kernel.unprivileged_bpf_disabled=0).README.md:8-12README.md:660-678
  • Vagrant with libvirt provider (optional, for the provided lab).README.md:660-678

Evidence-described exercise path

  1. Build the exploit binary using the provided Docker environment: run './build.sh' from the project root.README.md:660-662build.sh:1-4
  2. Set up a vulnerable target system (e.g., using the Vagrant lab: 'cd lab && vagrant up && vagrant ssh').README.md:660-678
  3. Run the compiled exploit binary on the target: '/exploit/target/release/cve_2022_23222'.README.md:660-678
  4. The exploit leaks a kernel address, finds a target process's cred structure, overwrites UID/GID to zero, and resumes the process to spawn a root shell.src/exploit/exploit.c:1-507README.md:660-678
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and build script only set up a compilation environment and do not execute the exploit. The exploit code targets a kernel vulnerability for local privilege escalation within a lab context, with no hidden or unnecessary behavior directed at the host, external systems, or persistence. The Vagrant lab is a contained test environment.

Dockerfile:1-12build.sh:1-4src/exploit/exploit.c:1-507README.md:660-678
Review boundaries

What the analysis did not establish

  • The Vagrantfile (lab/Vagrantfile) is not included in the evidence files; its exact configuration is unknown.
  • The exploit binary is compiled but not inspected; its runtime behavior is inferred from source code.
  • The Dockerfile does not include the exploit source; the build script mounts the host directory, which could introduce untracked files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 15