A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

🗓️ 23 Feb 2022 08:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 2 Views

Heap overflow in legacy_parse_param of Linux Filesystem Context API enables privilege escalation.

Reporter	Title	Published	Views	Family All 427
GithubExploit	Exploit for Improper Privilege Management in Linux Linux_Kernel	24 Mar 202207:04	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	18 Feb 202209:27	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	5 Apr 202207:48	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	25 Feb 202616:13	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	5 Mar 202612:56	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	14 Apr 202210:46	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	15 Apr 202402:42	–	githubexploit
GithubExploit	Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel	26 Jan 202216:27	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Docker	14 Feb 202604:10	–	githubexploit
GithubExploit	Exploit for Race Condition in Canonical Ubuntu_Linux	4 Feb 202601:58	–	githubexploit

Vulners

Node

microsoft cbl2_kernel_5.15.26.1-1Range<5.15.26.1-1

OR

microsoft cm1_kernel_5.10.93.1-4Range<-

23 Feb 2022 08:00Current

7.7High risk

Vulners AI Score7.7

CVSS 27.2

CVSS 3.18.4

EPSS0.018

SSVC

heap overflow legacy parse param linux kernel filesystem context api privilege escalation unprivileged user