CVE-2022-0185
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2Mailing ListPatch
- github.com/Crusaders-of-Rust/CVE-2022-0185ExploitThird Party Advisory
- security.netapp.com/advisory/ntap-20220225-0003/Third Party Advisory
- openwall.com/lists/oss-security/2022/01/18/7Mailing ListPatch
- willsroot.io/2022/01/cve-2022-0185.htmlExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 776 days
- CVSS
- 8.4 HIGH
- EPSS (30-day exploit probability)
- 25.2% · top 2% of all CVEs
- Weakness
- CWE-190
- Preconditions
- No privileges and no user interaction
- 1.Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.