Vulnerabilities > CVE-2022-0185 - Integer Underflow (Wrap or Wraparound) vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://github.com/Crusaders-of-Rust/CVE-2022-0185
- https://www.openwall.com/lists/oss-security/2022/01/18/7
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2
- https://www.willsroot.io/2022/01/cve-2022-0185.html
- https://security.netapp.com/advisory/ntap-20220225-0003/