Linux Kernel Heap-Based Buffer Overflow Vulnerability (CVE-2022-0185)

A local attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2024-09-11 under CISA BOD 22-01.

This is a Integer Overflow (CWE-190) vulnerability in Linux Kernel. A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Exploitation requires local access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: https://github.com/Crusaders-of-Rust/CVE-2022-0185