Detect CVE-2022-0995 - Linux Kernel watch_queue Out-of-Bounds Write Privilege Escalation in Microsoft Sentinel
Detects exploitation and presence of CVE-2022-0995, a heap out-of-bounds write vulnerability in the Linux kernel's watch_queue event notification subsystem (kernel/watch_queue.c). The flaw stems from watch_queue_set_filter() failing to correctly bound the number of filter types (nr_filter) against the underlying bitmap, allowing an unprivileged local user to write past the end of a heap allocation. Successful exploitation corrupts kernel heap memory and leads to local privilege escalation to root. This CVE is listed in CISA KEV. Detection focuses on process telemetry indicating watch_queue exploitation primitives (keyctl/pipe watch_queue usage from unusual processes), kernel oops/panic signatures, and post-exploitation privilege escalation behavior.
MITRE ATT&CK
- Tactic
- Privilege Escalation Execution
KQL Detection Query
// CVE-2022-0995: watch_queue OOB write privilege escalation on Linux
let suspiciousProcs = dynamic(["watch_queue", "exploit", "cve-2022-0995", "poc", "lpe"]);
Syslog
| where Facility in ("kern", "auth", "authpriv") or SyslogMessage has_any ("watch_queue", "BUG: unable to handle", "general protection fault", "kernel BUG at", "slab-out-of-bounds", "KASAN")
| where SyslogMessage has_any ("watch_queue", "post_one_notification", "watch_queue_set_filter", "slab-out-of-bounds", "Oops", "general protection fault")
| extend HostName = Computer, Kernel = extract(@"([0-9]+\.[0-9]+\.[0-9]+[^ ]*)", 1, SyslogMessage)
| project TimeGenerated, HostName, Facility, SeverityLevel, SyslogMessage, Kernel
| order by TimeGenerated descSurfaces kernel log messages indicating watch_queue subsystem faults, KASAN slab-out-of-bounds reports, or kernel oops/GPF consistent with CVE-2022-0995 exploitation on Linux hosts forwarding Syslog to Sentinel.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate kernel debugging or KASAN-enabled test builds producing slab-out-of-bounds messages
- Unrelated kernel oops caused by faulty hardware or third-party drivers
- Security researchers running watch_queue benchmarks in a sandbox
Other platforms for CVE-2022-0995
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Detect vulnerable kernel version for CVE-2022-0995
Expected signal: Process execution events for uname and grep/zcat reading kernel config; no kernel faults expected.
- Test 2Simulate watch_queue exploitation primitive (lab-only)
Expected signal: ProcessRollup2/execve events showing an unprivileged UID executing a binary named 'watch_queue' and keyctl activity.
- Test 3Emulate kernel KASAN out-of-bounds log signature
Expected signal: Kernel syslog/journald entry containing 'KASAN: slab-out-of-bounds in watch_queue_set_filter'.
References (4)
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2022-0995
Response Playbook
Triage
- Identify the affected Linux host and confirm the running kernel version via `uname -r`; determine whether it predates the fix commit 93ce93587d36 (watch_queue_set_filter bounds fix).
- Review kernel logs (`dmesg`, /var/log/kern.log, journalctl -k) for watch_queue references, KASAN slab-out-of-bounds reports, or kernel oops/GPF around the alert time.
- Correlate the process telemetry: identify which unprivileged UID launched watch_queue/keyctl primitives and whether a root-owned shell or new UID=0 process followed within minutes.
- Check whether watch_queue is even enabled (CONFIG_WATCH_QUEUE) on the host; hosts without it are not exploitable via this path.
Containment
- Isolate the affected host from the network if a successful root escalation is confirmed, preserving volatile memory where feasible.
- Kill the offending process tree and disable the compromised local account pending investigation.
- Apply the vendor kernel update containing commit 93ce93587d36 and reboot; if patching is not immediate, restrict local access and consider mounting untrusted user filesystems noexec.
Evidence Collection
- Capture full kernel ring buffer (`dmesg -T`) and journald kernel logs, plus /var/log/kern.log and /var/log/auth.log.
- Collect the suspect binary, its hashes, and process ancestry (auditd execve records) for the unprivileged and subsequent root processes.
- Preserve a memory image (LiME/avml) if kernel corruption is suspected, before rebooting.
Escalation Criteria
- !Escalate to incident response if a root shell or UID=0 process is confirmed to descend from an unprivileged exploit process.
- !Escalate if KASAN/slab-out-of-bounds or a kernel oops referencing watch_queue is observed on a production host.
- !Escalate if the affected host runs an unpatched kernel and hosts sensitive data or serves multi-tenant local users.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Kernel ring buffer / journald entries referencing watch_queue, watch_queue_set_filter, or KASAN slab-out-of-bounds - >
auditd execve records showing an unprivileged process invoking keyctl/watch_queue primitives followed by a UID=0 process - >
Dropped exploit binaries in world-writable paths (/tmp, /dev/shm) and their inode/mtime metadata
Tuning Guidance
Baseline legitimate keyctl and watch_queue usage in your environment (some backup, systemd, and key-management tooling use the keyring) to reduce noise on the process-sequence queries. Suppress KASAN slab-out-of-bounds alerts originating from known debug/test kernels by excluding those host groups. Prioritize alerts where an unprivileged UID's watch_queue activity is followed by a UID=0 process within a short window, and where the running kernel predates the fix commit.
Hunting Queries
Hunts for kernel watch_queue/KASAN out-of-bounds signatures across Linux fleet grouped by host and time.
Syslog | where SyslogMessage has_any ("watch_queue", "slab-out-of-bounds", "watch_queue_set_filter") | summarize count() by Computer, bin(TimeGenerated, 1h)index=os (facility=kern OR component=kernel) ("watch_queue" OR "slab-out-of-bounds" OR "watch_queue_set_filter") | stats count by host, _timeAtomic Red Team Tests
Enumerates the running kernel and checks whether watch_queue support is compiled in, indicating potential exposure to CVE-2022-0995.
Command
uname -r; grep -E 'CONFIG_WATCH_QUEUE' /boot/config-$(uname -r) 2>/dev/null || zcat /proc/config.gz 2>/dev/null | grep CONFIG_WATCH_QUEUECleanup
trueExpected Telemetry
Process execution events for uname and grep/zcat reading kernel config; no kernel faults expected.
Expected Detection
Not a direct detection; informs exposure assessment. Process telemetry may appear in vulnerability-hunting baselines.
Runs a benign process named to emulate a watch_queue exploit invoking keyctl/pipe watch_queue setup from an unprivileged user, to validate process-sequence detections. Does NOT trigger the real OOB write.
Command
cp /bin/true /tmp/watch_queue && /tmp/watch_queue; keyctl show 2>/dev/null || trueCleanup
rm -f /tmp/watch_queueExpected Telemetry
ProcessRollup2/execve events showing an unprivileged UID executing a binary named 'watch_queue' and keyctl activity.
Expected Detection
Elastic EQL and CrowdStrike CQL process-sequence rules flag unprivileged watch_queue/keyctl execution.
Writes a synthetic KASAN slab-out-of-bounds / watch_queue message to the kernel log via /dev/kmsg to validate syslog-based detections (requires root; lab-only).
Command
echo 'BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x1a0/0x200 CVE-2022-0995-sim' > /dev/kmsgCleanup
trueExpected Telemetry
Kernel syslog/journald entry containing 'KASAN: slab-out-of-bounds in watch_queue_set_filter'.
Expected Detection
KQL Syslog, SPL, QRadar AQL, Sumo Logic, and Chronicle YARA-L rules match the watch_queue/KASAN signature.