{"id":"CVE-2022-0185","kind":"vulnerability","aliases":["CVE-2022-0185"],"related":[],"title":"A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context…","description":"A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.","summary":"The Linux kernel has a heap-based buffer overflow in the legacy_parse_param function in its Filesystem Context code. An attacker who can mount a filesystem can overflow kernel memory and escalate to root.","severity":"high","cvss":8.4,"epss":null,"exploited":true,"exploited_at":"2024-08-21T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["5.4.173"],"affected":">= 5.1, < 5.4.173","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.93"],"affected":">= 5.5, < 5.10.93","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.16"],"affected":">= 5.11, < 5.15.16","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.16.2"],"affected":">= 5.16, < 5.16.2","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h300e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700e firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Apply the Linux kernel update from your distribution or vendor that fixes CVE-2022-0185; discontinue use of unpatched systems if no update is available.","status":"open","published_at":"2022-02-11T18:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:22+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:58:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Linux kernel update from your distribution or vendor that fixes CVE-2022-0185; discontinue use of unpatched systems if no update is available.","reach":"local","impact":"high","summary":"The Linux kernel has a heap-based buffer overflow in the legacy_parse_param function in its Filesystem Context code. An attacker who can mount a filesystem can overflow kernel memory and escalate to root.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local user escalates privileges to root on the kernel","analyst_note":"Sources do not list affected or fixed kernel versions or a check command; find the fixed versions in the kernel git commit and distro advisories, and confirm whether unprivileged user namespaces are needed to trigger it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000469,"input_tokens":2845,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0185':24A,27A '-2022':23A,26A 'abl':154C 'admin':150C 'api':166C 'attack':91B 'base':4A,76B,108C 'buffer':5A,77B,109C 'cap':148C 'case':139C 'code':89B 'context':21A,88B,125C,165C 'could':173C 'cve':22A,25A 'enabl':144C 'escal':102B,178C 'exploit':62B 'fallback':169C 'filesystem':20A,87B,96B,124C,158C,164C 'firmware':38A,41A,44A,47A,50A,53A,56A,59A 'flaw':7A,111C,176C 'found':9A,113C 'function':17A,84B,121C,126C 'h300e':49A 'h300s':40A 'h410c':37A 'h410s':58A 'h500e':52A 'h500s':43A 'h700e':55A 'h700s':46A 'handl':172C 'heap':3A,75B,107C 'heap-bas':2A,74B,106C 'host':68B 'infrastructur':63B 'kernel':29A,31A,33A,35A,61A,71B,99B,130C 'kubernet':64B 'legaci':14A,81B,118C,171C 'length':135C 'linux':28A,30A,32A,34A,60A,65B,70B,129C 'local':152C 'memori':100B 'mount':94B 'namespac':143C,147C 'need':146C 'netapp':36A,39A,42A,45A,48A,51A,54A,57A 'open':156C 'otherwis':145C 'overflow':6A,78B,98B,110C 'param':16A,83B,120C 'paramet':134C 'pars':15A,82B,119C 'privileg':151C,180C 'root':104B 'self':67B 'self-host':66B 'suppli':133C 'support':162C 'sys':149C 'system':183C 'thus':168C 'unprivileg':137C,141C 'use':174C 'user':142C,153C 'verifi':131C 'way':12A,116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-11T18:15:10+00:00","kev":{"dateAdded":"2024-08-21","dueDate":"2024-09-11","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-0185","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0185","severity":null,"published_at":"2024-08-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-0185","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0185","severity":null,"published_at":"2022-02-11T18:15:10+00:00","modified_at":"2026-06-17T04:20:06+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}