Linux Kernel Heap-Based Buffer Overflow Vulnerability (CVE-2022-0185)
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
A local attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2024-09-11 under CISA BOD 22-01.
This is a Integer Overflow (CWE-190) vulnerability in Linux Kernel. A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Exploitation requires local access, low attack complexity, no authentication required, and no user interaction required.
Probably yes if any of these apply:
Active exploitation documented in the wild. Threat-research write-up: https://github.com/Crusaders-of-Rust/CVE-2022-0185
Manual remediation steps
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.