CVE-2022-0185 · netVigilance record NV24-0102

Linux Kernel Heap-Based Buffer Overflow

past due

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CISA deadline 2024-09-11 · passed 1 year 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.

Who is affected

Linux Kernel. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-190.

Timeline

2024-08-21
Added to CISA KEVExploitation in the wild confirmed by CISA
2024-09-11
CISA remediation deadlinepassed 1 year 11 months ago

Sources

NVD entry for CVE-2022-0185 nvd.nist.gov/vuln/detail/CVE-2022-0185
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
git.kernel.org git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=722d94847de2
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2022-0185