CVSS 3.1
8.4 highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-0185
High (8.4) in Linux Kernel. In CISA KEV since 2024-08-21. EPSS 25% chance of exploitation in the next 30 days.
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Severity
- EPSS
- 25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2024-08-21, due 2024-09-11
- CWEs
- CWE-191, CWE-190
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linux:linux_kernel
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2
- https://github.com/Crusaders-of-Rust/CVE-2022-0185
- https://security.netapp.com/advisory/ntap-20220225-0003/
- https://www.openwall.com/lists/oss-security/2022/01/18/7
- https://www.willsroot.io/2022/01/cve-2022-0185.html