高危
Linux kernel legacy_parse_param函数堆缓冲区溢出漏洞
2022-01-18 00:00:00 公开 ，2025-10-22 00:50:04 更新
- CISA KEV
- 关键漏洞
- 本地
- 公开PoC
- CWE Top 25 (2023)
- 无需认证
- 开源组件漏洞
- CWE Top 25 (2024)
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2024-08-22 20:49:08
风险信息
- CVSS v2 向量
- AV:L/AC:L/Au:N/C:C/I:C/A:C
- CVSS v2 风险值
- 7.2
- CVSS v3 向量
- AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 8.4
- CVSS v3.1 向量
- AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.4
详细信息
- 漏洞类型
- 输入验证错误
- 漏洞描述
- Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。Linux kernel存在输入验证错误漏洞，该漏洞源于在Linux kernel的Filesystem Context中的legacy_parse_param函数验证提供的参数长度的方式中存在基于堆的缓冲区溢出缺陷。 非特权（在启用非特权用户命名空间的情况下，否则需要命名空间的CAP_SYS_ADMIN特权）本地用户能够打开不支持文件系统上下文API的文件系统（因此回退到遗留处理），可以使用此缺陷来提升在系统上的权限。
- 修复建议
- 此漏洞会影响通用开源组件、第三方库及其它产品。更多信息请参考如下链接： https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=722d94847de2
参考链接
- https://bugzilla.redhat.com/show_bug.cgi?id=2034813
OSV
- https://bugzilla.redhat.com/show_bug.cgi?id=2040358
OSV
- https://errata.rockylinux.org/RLSA-2022:0176
OSV
- https://errata.rockylinux.org/RLSA-2022:0188
OSV
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2
CVE · x_refsource_MISC
- https://github.com/Crusaders-of-Rust/CVE-2022-0185
CVE · x_refsource_MISC
- https://osv.dev/vulnerability/ALSA-2022:0188
OSV
- https://osv.dev/vulnerability/DSA-5050-1
OSV
- https://osv.dev/vulnerability/RLSA-2022:0176
OSV
- https://osv.dev/vulnerability/RLSA-2022:0188
OSV
- https://security.netapp.com/advisory/ntap-20220225-0003/
CVE · x_refsource_CONFIRM
- https://vulners.com/cve/CVE-2021-4155
OSV
- https://vulners.com/cve/CVE-2022-0185
OSV
- https://www.openwall.com/lists/oss-security/2022/01/18/7
CVE · x_refsource_MISC
- https://www.willsroot.io/2022/01/cve-2022-0185.html
CVE · x_refsource_MISC
- https://source.android.com/security/bulletin/2022-06-01
OSV
- https://android.googlesource.com/kernel/common/+/a32e89883a535
OSV
- https://android.googlesource.com/kernel/common/+/eadde287a62e6
OSV
- https://osv.dev/vulnerability/PUB-A-213172369
OSV
- https://ubuntu.com/security/CVE-2022-0185
OSV
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de29310e8aa03fcbdb41fc92c521756
OSV
- https://ubuntu.com/security/notices/USN-5240-1
OSV
- https://ubuntu.com/security/notices/USN-5362-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2022-0185
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2022-0185
OSV
- https://security-tracker.debian.org/tracker/CVE-2022-0185
OSV
- https://osv.dev/vulnerability/CVE-2022-0185
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2022-0185
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185
NVD · US Government Resource