CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
Description
CVE-2022-0185 is a high-severity heap-based buffer overflow vulnerability (CVSS 8.4) in the Linux kernel's Filesystem Context functionality, specifically in the legacy_parse_param function. Affecting kernel versions from 5.1 through 5.16.2, this flaw allows an unprivileged local user (when unprivileged user namespaces are enabled) to crash the system or escalate privileges to root. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 1.35% (79.8th percentile), it represents a significant local privilege escalation threat, and multiple public exploits are available.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 5.1, < 5.4.173; >= 5.5, < 5.10.93; >= 5.11, < 5.15.16; >= 5.16, < 5.16.2 |
| netapp | h410c firmware | - |
| netapp | h300s firmware | - |
| netapp | h500s firmware | - |
| netapp | h700s firmware | - |
| netapp | h300e firmware | - |
| netapp | h500e firmware | - |
| netapp | h700e firmware | - |
| netapp | h410s firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2(Mailing List, Patch)
- https://github.com/Crusaders-of-Rust/CVE-2022-0185(Exploit, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20220225-0003/(Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2022/01/18/7(Mailing List, Patch, Third Party Advisory)
- https://www.willsroot.io/2022/01/cve-2022-0185.html(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185(US Government Resource)
Weakness Type
Heap-Based Buffer Overflow
This vulnerability is a heap-based buffer overflow in the Linux kernel's Filesystem Context API, specifically within the legacy_parse_param function. A heap-based buffer overflow occurs when data is written beyond the allocated buffer boundary in heap memory, potentially overwriting adjacent data structures. In the Linux kernel, the legacy_parse_param function processes filesystem mount parameters for filesystems that do not support the newer Filesystem Context API. The function failed to properly validate the length of supplied parameters, allowing an attacker to provide parameters that exceed the expected buffer size and corrupt adjacent kernel heap memory. Kernel heap overflows are particularly dangerous because they can be leveraged for privilege escalation to root, kernel code execution, or system-level denial of service.
Impact Analysis
The CVSS score of 8.4 (High) reflects the severe local impact of this vulnerability. Confidentiality impact is rated High, meaning an attacker who achieves privilege escalation can read any data on the system, including sensitive files, credentials, encryption keys, and other users' data. Integrity impact is also High, as root-level access enables modification of any system file, installation of rootkits, tampering with audit logs, and manipulation of running processes. Availability impact is High, with the vulnerability capable of causing kernel panics and system crashes even without a full exploitation chain.
The business impact centers on the Linux kernel's ubiquity across enterprise infrastructure, cloud platforms, and containerized environments. Privileges Required (None) in the CVSS vector is noteworthy — while the vulnerability is local, it does not require any authentication when unprivileged user namespaces are enabled, which is the default on many modern Linux distributions including Ubuntu. This makes the vulnerability exploitable by any local user or by code running in an unprivileged container. The EPSS score of 1.35% (79.8th percentile) indicates an above-average exploitation probability. The availability of multiple public exploits, including a proof-of-concept from the Crusaders of Rust team, significantly lowers the barrier for exploitation. The ransomware association is unknown, but privilege escalation vulnerabilities in the Linux kernel are frequently used as part of broader attack chains in cloud and container environments.
Exploit Maturity
CVE-2022-0185 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 11, 2024. Multiple public exploits are available, including a well-documented proof-of-concept by the Crusaders of Rust and a detailed technical writeup by Will's Root. The availability of weaponized exploit code makes this vulnerability accessible to a wide range of attackers, from sophisticated threat actors to opportunistic attackers using automated exploitation frameworks. The EPSS score of 1.35% (79.8th percentile) reflects the elevated exploitation probability. The exploit has been demonstrated to work for container escape scenarios, making it relevant for cloud and Kubernetes environments where containers may share the host kernel. The ransomware association is unknown, though kernel privilege escalation exploits are commonly used in attack chains that ultimately deploy ransomware.
Remediation
-
Update the Linux kernel immediately — Upgrade to a patched kernel version: 5.4.173 or later (for the 5.4 LTS branch), 5.10.93 or later (5.10 LTS), 5.15.16 or later (5.15 LTS), or 5.16.2 or later (5.16 mainline). Apply the upstream kernel patch from the Linux kernel Git repository.
-
Disable unprivileged user namespaces as a mitigation — If immediate patching is not possible, disable unprivileged user namespaces by setting the sysctl parameter:
sysctl -w kernel.unprivileged_userns_clone=0. This removes the unprivileged exploitation path, though it may affect container workloads and some applications that rely on user namespaces. -
Update NetApp firmware if applicable — If you run NetApp H-series appliances (H410C, H300S, H500S, H700S, H300E, H500E, H700E, H410S), apply the relevant firmware updates from NetApp's security advisory to address this vulnerability in their embedded Linux kernels.
-
Audit container runtime configurations — Review container orchestration platforms (Kubernetes, Docker) to ensure containers are running with minimal privileges. Implement security profiles (AppArmor, SELinux, seccomp) that restrict the syscalls containers can make, reducing the exploitability of kernel vulnerabilities from within containers.
-
Deploy kernel runtime protection — Implement kernel-level security tools such as kernel lockdown mode, eBPF-based security monitoring, or commercial runtime protection solutions that can detect and block exploitation attempts targeting kernel memory corruption vulnerabilities.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reveals an unusually powerful local vulnerability. Attack Vector (Local) means the attacker needs local access to the system, but this includes access through containers, SSH, or any local code execution. Attack Complexity (Low) indicates exploitation requires no special conditions. Privileges Required (None) is critical — when unprivileged user namespaces are enabled (the default on Ubuntu and many distributions), no special privileges are needed. User Interaction (None) confirms fully automated exploitation is possible. All three impact metrics are High, reflecting the full system compromise possible through kernel-level code execution.
The vulnerability exists in the legacy_parse_param function within the Linux kernel's Filesystem Context functionality. This function handles parameter parsing for filesystems that do not implement the newer fs_context-based mount API, falling back to a legacy path. The flaw is a missing length validation: when legacy_parse_param receives a filesystem mount parameter, it fails to properly verify that the parameter length does not exceed the allocated buffer size. An attacker can trigger this code path by opening a filesystem that uses the legacy mount API and supplying an oversized parameter. This causes a heap-based buffer overflow where data is written past the end of the allocated kernel heap buffer, corrupting adjacent heap objects. By carefully controlling the heap layout through heap spraying techniques and providing a precisely crafted overflow payload, an attacker can overwrite kernel data structures to gain arbitrary kernel read/write capabilities, ultimately escalating to root privileges. The exploit is particularly effective in environments with unprivileged user namespaces enabled, as the CAP_SYS_ADMIN capability required for filesystem mounting can be obtained within a user namespace without any real privileges.
Frequently Asked Questions
What is CVE-2022-0185?
CVE-2022-0185 is a high-severity heap-based buffer overflow vulnerability in the Linux kernel's Filesystem Context functionality. It allows local users to crash the kernel or escalate privileges to root by exploiting a parameter length validation failure in the legacy_parse_param function. Multiple public exploits are available.
Can this vulnerability be exploited without root privileges?
Yes, when unprivileged user namespaces are enabled (the default on Ubuntu and many distributions), no special privileges are required. The attacker can create a user namespace to obtain the CAP_SYS_ADMIN capability needed for filesystem operations, making the vulnerability exploitable by any local user or from within an unprivileged container.
Which Linux kernel versions are affected?
The vulnerability affects kernel versions from 5.1 through 5.16.1. Specifically, the following ranges are affected: 5.1 to 5.4.172, 5.5 to 5.10.92, 5.11 to 5.15.15, and 5.16 to 5.16.1. Fixed versions are 5.4.173, 5.10.93, 5.15.16, and 5.16.2 respectively.
Is this vulnerability relevant to containerized environments?
Yes, this vulnerability is highly relevant to containerized and Kubernetes environments. Containers typically share the host kernel, and the exploit can be used to escape container isolation when user namespaces are available. Organizations running containers on vulnerable kernel versions should prioritize patching and implement runtime security controls.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.