CVE-2022-30594

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · May 12, 2022

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag, possibly disabling seccomp.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

If ptrace is not required, ptrace can be disabled in multiple ways.

SELinux policy.

setsebool -P deny_ptrace on

Kernel sysctl.

sysctl -w kernel.yama.ptrace_scope=3

Or to make persistent , create

/etc/sysctl.d/99-yama-ptrace_scope.conf

kernel.yama.ptrace_scope=3

If you need further assistance, see the KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-276 · Incorrect Default Permissions