CVE-2022-0185
Linux Kernel: Heap-Based Buffer Overflow
As of , CVE-2022-0185 in Linux Kernel is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 21 August 2024
- US federal deadline
- 11 September 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.25Higher than 97% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.00 on 21 August 2024EPSS on the day CISA listed it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: git.kernel.orgLinks below, from CISA's entry.
What CISA says to do
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA's required action
- git.kernel.orgThis vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more…
What the flaw is
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
CISA's description
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
The CVE record's description, from redhat
- CVE published
- 11 February 2022
- Assigned by
- redhat
- CVSS
- 8.4 High (CVSS 3.1, from CISA-ADP)
- CWE-190
- Integer Overflow or Wraparound
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Kernel: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-39682Improper Check for Unusual or Exceptional Conditions | Linux Kernel | Patch nowForensic triage required by CISA | 0.03 | ||
| CVE-2025-39964Race Condition | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2026-53266Out-of-Bounds Write | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2026-53362Unspecified | Linux Kernel | Patch nowForensic triage required by CISA | 0.01 | ||
| CVE-2021-22555Heap Out-of-Bounds Write | Linux Kernel | Patch this weekMetasploit module; EPSS 0.79; verified Exploit-DB entry | 0.79 | ||
| CVE-2013-6282Improper Input Validation | Linux Kernel | Patch this weekMetasploit module; verified Exploit-DB entry | 0.40 | ||
| CVE-2019-13272Improper Privilege Management | Linux Kernel | Patch this weekMetasploit module; EPSS 0.52; verified Exploit-DB entry | 0.52 | ||
| CVE-2010-3904Improper Input Validation | Linux Kernel | Patch this weekMetasploit module; verified Exploit-DB entry | 0.16 | ||
| CVE-2022-0847Privilege Escalation | Linux Kernel | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| CVE-2021-3493Privilege Escalation | Linux Kernel | Patch this weekMetasploit module | 0.49 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org