A vulnerability (CVE-2022-1729) has been identified in the Linux kernel, allowing a local user to gain root access to the system. This vulnerability is caused by a race condition in the perf subsystem, which can be exploited to access already freed kernel memory (use-after-free). The issue has been present since the release of kernel 4.0-rc1, and exploitation has been confirmed for releases 5.4.193 and above.
A fix is currently available only in the form of a patch. The risk posed by this vulnerability is mitigated by the fact that most distributions, by default, restrict access to perf for unprivileged users. As a workaround, the sysctl parameter kernel.perf_event_paranoid can be set to a value of 3 to enhance protection.
Source: opennet.ru
