PT-2022-1934 · Linux+10 · Linux Kernel+10
Chop0
+6
·
Published
2022-01-18
·
Updated
2026-04-08
·
CVE-2022-0185
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions 5.1 through 5.15.1
Linux Kernel versions prior to 5.16.2
Linux Kernel versions prior to 5.15.16
Linux Kernel versions prior to 5.10.93
Linux Kernel versions prior to 5.4.173
Description
A heap-based buffer overflow flaw was found in the way the legacy parse param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged local user able to open a filesystem that does not support the Filesystem Context API could use this flaw to escalate their privileges on the system. The vulnerability allows a local attacker to cause a denial of service or execute arbitrary code. It can also be used to escape Kubernetes containers.
Recommendations
For Linux Kernel versions 5.1 through 5.15.1, update to version 5.16.2 or later.
For Linux Kernel versions prior to 5.15.16, update to version 5.15.16 or later.
For Linux Kernel versions prior to 5.10.93, update to version 5.10.93 or later.
For Linux Kernel versions prior to 5.4.173, update to version 5.4.173 or later.
As a temporary workaround, consider setting the sysctl "user.max user namespaces" to 0 to prevent exploitation.
Exploit
Fix
Integer Underflow
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linux Kernel
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu