Security readout for executives and security teams
Plain-English summary
CVE-2022-0185 is a Linux kernel privilege-escalation flaw. A local user or process may abuse faulty filesystem parameter length handling to gain higher privileges. CISA lists it in KEV, so organizations with potentially vulnerable Linux systems should treat remediation as urgent.
Executive priority
High priority. This is a known-exploited local privilege-escalation issue in the Linux kernel. It may turn a limited foothold into full system compromise, making rapid patch validation important for shared, containerized, and high-value systems.
Technical view
The flaw is a heap-based buffer overflow in legacy_parse_param within Linux Filesystem Context legacy handling. It affects filesystems falling back from the newer API. Exploitation is local; it can be unprivileged when unprivileged user namespaces are enabled, otherwise namespaced CAP_SYS_ADMIN is required.
Likely exposure
Exposure is most likely on Linux systems running vulnerable kernels, especially container hosts or multi-user systems where unprivileged user namespaces are enabled. The source bundle does not enumerate distribution-specific fixed versions; confirm against kernel and vendor advisories.
Exploitation context
CISA KEV inclusion supports known exploitation in the wild. Public references also include exploit-oriented research and proof-of-concept material, but this assessment does not rely on or reproduce weaponization details.
Researcher notes
Key exposure conditions are local code execution plus vulnerable legacy filesystem context parsing. The bundle identifies the upstream kernel fix and KEV status, but lacks a complete affected-version matrix. Avoid assuming distro coverage without checking vendor advisories.
Mitigation direction
- Apply kernel or vendor updates that include the upstream fix.
- Prioritize internet-facing container hosts and shared Linux systems.
- Check vendor advisories for distribution-specific fixed kernel versions.
- If patching is delayed, review vendor guidance on unprivileged user namespaces.
- Track NetApp guidance where their affected products are in use.
Validation and detection
- Inventory Linux kernel versions across servers, containers hosts, and appliances.
- Check whether unprivileged user namespaces are enabled on Linux systems.
- Map running kernels to vendor advisories or the upstream fixed commit.
- Confirm CISA KEV remediation deadlines in vulnerability management tooling.
- Review EDR and host telemetry for local privilege escalation indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-0185 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2CVE reference · x_refsource_MISC
- https://github.com/Crusaders-of-Rust/CVE-2022-0185CVE reference · x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2022/01/18/7CVE reference · x_refsource_MISC
- https://www.willsroot.io/2022/01/cve-2022-0185.htmlCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220225-0003/CVE reference · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0185CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.