48 lines
2.3 KiB
Markdown
48 lines
2.3 KiB
Markdown
# CVE-2022-0185: kernel heap overflow in legacy_parse_param, reachable from an unprivileged user namespace
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
CVSS 8.4 (NVD), CISA KEV. Introduced in Linux 5.1-rc1, fixed 18 Jan 2022.
|
|
|
|
## Source
|
|
|
|
- [oss-sec disclosure](https://seclists.org/oss-sec/2022/q1/55)
|
|
- [Hack The Box case study](https://www.hackthebox.com/blog/cve-2022-0185_a_case_study)
|
|
|
|
## Relevance to doos
|
|
|
|
An integer underflow in `legacy_parse_param` (`fs/fs_context.c`) let a filesystem mount
|
|
option string trigger a heap buffer overflow. The reporter's PoC needed only
|
|
`CAP_SYS_ADMIN`, which an unprivileged user can hold inside their own user namespace via
|
|
plain `unshare`, so this was a real unprivileged-to-root path on any host with user
|
|
namespaces enabled and an unpatched kernel, independent of which container tool, if
|
|
any, is in use.
|
|
|
|
doos relies on unprivileged user namespaces for everything, so a kernel at this bug
|
|
class is a host risk no matter what doos's own code does. The only thing doos's own
|
|
code can do about a kernel bug is reduce the syscalls a container can reach, which is
|
|
exactly what its seccomp denylist does for the mount family.
|
|
|
|
|
|
## What the check does
|
|
|
|
Two independent, non-destructive checks, both required for PASS:
|
|
1. Kernel version against the fixed table (`uname -r`). Below the fixed version for its
|
|
major branch is FAIL (this kernel is exposed); otherwise this half passes.
|
|
2. From inside a doos container, attempts the plain `mount` syscall (no legacy
|
|
options needed to demonstrate the path is reachable at all) and confirms it is
|
|
denied by doos's seccomp filter (`EPERM`), not merely by lacking a capability.
|
|
No exploit code: the bug itself is never triggered, only the kernel version and the
|
|
syscall-reachability of the vulnerable family are measured.
|
|
|
|
|
|
## Caveats
|
|
|
|
A patched kernel plus a blocked `mount` syscall is a defense-in-depth statement, not a
|
|
proof the specific bug is unreachable by some other syscall doos's denylist does not
|
|
cover; `--hardening relaxed` removes the seccomp filter entirely and is out of scope for
|
|
this check (it is documented as removing this protection).
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|