CVE-2022-0185: Linux Kernel Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAPSYSADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Other sources
Linux kernel contains a heap-based buffer overflow vulnerability in the legacyparseparam function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
— CISA
Linux Kernel is vulnerable to a heap-based buffer overflow, caused by an integer underflow in the legacyparseparam function in fs/fscontext.c. By sending a specially-crafted request, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.12.2.rt7.143.el8_5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.12.2.el8_5 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.34.2.rt7.107.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.34.2.el8_4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1 - Configuration
# echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf Note: On containerized deployments (such as Red Hat OpenShift Container Platform) do not apply this mitigation because the functionality is required.
Linux kernel (sysctl) user.max_user_namespaces = 0 - Configuration
Run: sysctl -w kernel.unprivileged_userns_clone=0 Note: On containerized deployments (such as Red Hat OpenShift Container Platform) do not apply this mitigation because the functionality is required.
Linux kernel (sysctl) kernel.unprivileged_userns_clone = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-0185?
CVE-2022-0185 has been classified with a high severity rating due to the potential for heap-based buffer overflow which can lead to arbitrary code execution.
How do I fix CVE-2022-0185?
To address CVE-2022-0185, update your Linux kernel to versions 4.18.0-348.12.2.rt7.143.el8_5, 4.18.0-348.12.2.el8_5, or any subsequent unreleased patches.
What systems are affected by CVE-2022-0185?
CVE-2022-0185 affects various Linux kernel versions and specific Red Hat packages such as kernel-rt and kernel for versions up to 4.18.0-348.12.2.
Who can exploit CVE-2022-0185?
An unprivileged user may exploit CVE-2022-0185 if unprivileged user namespaces are enabled, allowing for unauthorized access to the affected systems.
Is CVE-2022-0185 easy to exploit?
Exploitation of CVE-2022-0185 can be relatively straightforward, as it may allow adversaries to execute arbitrary code with low complexity.