HIGH

CVE-2022-0185

Linux Linux Kernel 2022-02-11 CVSS v3.1

CVSS

8.4

KEV

Description

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

Summary dbcve.org

A heap-based buffer overflow exists in the Linux kernel's Filesystem Context functionality, specifically in the legacy_parse_param function, which fails to properly validate supplied parameter lengths. An unprivileged local user with CAP_SYS_ADMIN in user namespaces (or in certain fallback scenarios) can trigger the overflow to escalate privileges to root.

Mitigation

Apply the upstream kernel patch or update to a patched kernel version; restrict unprivileged user namespaces via sysctl or seccomp policies until patching is feasible.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-190 Integer Overflow

CWE-191

EPSS Score

25.15%

Probability of exploitation in next 30 days

97.9th percentile

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2 Mailing List, Patch https://github.com/Crusaders-of-Rust/CVE-2022-0185 Exploit, Third Party Advisory https://security.netapp.com/advisory/ntap-20220225-0003/ Third Party Advisory https://www.openwall.com/lists/oss-security/2022/01/18/7 Mailing List, Patch, Third Party Advisory https://www.willsroot.io/2022/01/cve-2022-0185.html Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE