CVE-2022-0185

CVE-2022-0185 is a heap-based buffer overflow in the legacy_parse_param function of the Linux kernel's Filesystem Context (fs_context) functionality, rooted in an integer-handling flaw (CWE-190). A local attacker triggers it by opening or configuring a filesystem that does not support the Filesystem Context API, which overflows the heap buffer used to hold mount parameters. Successful exploitation lets the attacker escalate privileges on the host, and in environments with user namespaces enabled (common on desktops, shared servers, and containers) it can lead to full root compromise and container escape. Any Linux kernel build containing the vulnerable code is affected, which spans the very large installed base of Linux servers, cloud instances, containers, and devices. The vulnerability is confirmed exploited in the wild (added to CISA KEV on 2024-08-21), carries an EPSS 30-day exploitation probability of 25.2% (98th percentile), has no known public PoC, and its use in ransomware campaigns is unknown.

What to do: Apply patched kernel packages from your distribution or vendor as soon as available and reboot to load the fixed kernel, per the KEV required action; do not continue running an unpatched vulnerable kernel. Where feasible, interim-mitigate by restricting or disabling unprivileged user namespaces (a common exploitation path), and prioritize hosts that are internet-facing, multi-tenant, or running containers. Verify remediation by confirming your running kernel is one of your vendor's patched builds, since no specific fixed version numbers are provided in this dataset.