CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow
A heap-based buffer overflow in the Linux kernel allows local attackers to escalate privileges via filesystem context parameters.
- Exploited in the wild
- Since 21 Aug 2024
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0185?
CVE-2022-0185 is a high-severity memory corruption vulnerability in Linux kernel, published on 11 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Which versions are affected by CVE-2022-0185?
It affects 9 products.
Linux distribution packages (6)
kernel-livepatch-SLE15-SP2_Update_21 SUSE:Linux Enterprise Live Patching 15 SP2 | All versions | 3-2.2 |
kernel-livepatch-SLE15-SP2_Update_22 SUSE:Linux Enterprise Live Patching 15 SP2 | All versions | 2-2.2 |
kernel-livepatch-SLE15-SP3_Update_10 SUSE:Linux Enterprise Live Patching 15 SP3 | All versions | 2-150300.2.2 |
kernel-livepatch-SLE15-SP3_Update_11 SUSE:Linux Enterprise Live Patching 15 SP3 | All versions | 2-150300.2.2 |
kernel-livepatch-SLE15-SP3_Update_9 SUSE:Linux Enterprise Live Patching 15 SP3 | All versions | 3-150300.2.2 |
kernel-source openSUSE:Tumbleweed | All versions | 5.16.2-1.1 |
Products include Linux kernel, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, Netapp H500e Firmware and 3 more.
How do I fix CVE-2022-0185?
Apply the vendor's patch. US federal agencies must fix it by 11 Sep 2024.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-0185 being exploited?
Yes. Attackers have exploited CVE-2022-0185 in the wild since at least 21 Aug 2024.
Public exploit code: 11 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as A-213172369, AZL-8578, DEBIAN-CVE-2022-0185, LSN-0084-1, MGASA-2022-0026, MGASA-2022-0027 and 6 more.