CVE-2022-0185: Linux Kernel Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAPSYSADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Other sources
In legacyparseparam of fscontext.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
Linux kernel contains a heap-based buffer overflow vulnerability in the legacyparseparam function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
— CISA
Linux Kernel is vulnerable to a heap-based buffer overflow, caused by an integer underflow in the legacyparseparam function in fs/fscontext.c. By sending a specially-crafted request, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.12.2.rt7.143.el8_5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.12.2.el8_5 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.34.2.rt7.107.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.34.2.el8_4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2022-06-05 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.15.15-1 - Configuration
On non-containerized Red Hat Enterprise Linux 8, disable unprivileged user namespaces by setting user.max_user_namespaces=0 in /etc/sysctl.d/userns.conf and applying it with sysctl -p /etc/sysctl.d/userns.conf; alternatively set kernel.unprivileged_userns_clone=0 with sysctl -w. Do not use this mitigation on containerized deployments such as Red Hat OpenShift Container Platform, where user namespaces are required.
Linux kernel user namespaces user.max_user_namespaces and kernel.unprivileged_userns_clone = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-0185?
CVE-2022-0185 has been classified with a high severity rating due to the potential for heap-based buffer overflow which can lead to arbitrary code execution.
How do I fix CVE-2022-0185?
To address CVE-2022-0185, update your Linux kernel to versions 4.18.0-348.12.2.rt7.143.el8_5, 4.18.0-348.12.2.el8_5, or any subsequent unreleased patches.
What systems are affected by CVE-2022-0185?
CVE-2022-0185 affects various Linux kernel versions and specific Red Hat packages such as kernel-rt and kernel for versions up to 4.18.0-348.12.2.
Who can exploit CVE-2022-0185?
An unprivileged user may exploit CVE-2022-0185 if unprivileged user namespaces are enabled, allowing for unauthorized access to the affected systems.
Is CVE-2022-0185 easy to exploit?
Exploitation of CVE-2022-0185 can be relatively straightforward, as it may allow adversaries to execute arbitrary code with low complexity.