PromptRiskDBThreat intelligence atlas

CVE-2022-0185 - Linux Kernel

AI Vulnerability Context

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to le...

Overview

A source-backed snapshot of this vulnerability.

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

CISA KEVyesWhether CISA lists this as exploited.
Techniques0AI attack methods connected to this vulnerability.
Case studies0Examples where this vulnerability is mentioned.

Vulnerability status

How serious this vulnerability is and whether it is known to be exploited.

CISA KEVHIGH
CVE ID
CVE-2022-0185
Vendor/project
Linux
Product
Kernel
Vulnerability name
Linux Kernel Heap-Based Buffer Overflow Vulnerability
Date added
2024-08-21
Due date
2024-09-11
Known ransomware campaign use
Unknown
CVSS v3
8.4
CWE-190

Exploit context

What the vulnerability is about.

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

Related AI techniques

AI attack methods connected to this vulnerability.

View all related techniques →
No related AI attack methods. No AI attack method is connected to this vulnerability in the current data.

Related case studies

Examples where this vulnerability is mentioned.

View all case studies →
No related case studies. No case study currently mentions this vulnerability.

Source evidence

Original public records and references for this page.

View all sources →

Original source

Original source links

Open the public records and source datasets used for this page.

NVD CVE pagehttps://nvd.nist.gov/vuln/detail/CVE-2022-0185CVE API docshttps://nvd.nist.gov/developers/vulnerabilitiesData feedshttps://nvd.nist.gov/vuln/data-feedsCataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogData repositoryhttps://github.com/cisagov/kev-dataaf854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2af854a3a-2127-422b-91ae-364da2661108https://github.com/Crusaders-of-Rust/CVE-2022-0185af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220225-0003/af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2022/01/18/7af854a3a-2127-422b-91ae-364da2661108https://www.willsroot.io/2022/01/cve-2022-0185.html134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185