CVE-2022-0185: kernel heap overflow in legacy_parse_param, reachable from an unprivileged user namespace
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 8.4 (NVD), CISA KEV. Introduced in Linux 5.1-rc1, fixed 18 Jan 2022.
Source
Relevance to doos
An integer underflow in legacy_parse_param (fs/fs_context.c) let a filesystem mount
option string trigger a heap buffer overflow. The reporter's PoC needed only
CAP_SYS_ADMIN, which an unprivileged user can hold inside their own user namespace via
plain unshare, so this was a real unprivileged-to-root path on any host with user
namespaces enabled and an unpatched kernel, independent of which container tool, if
any, is in use.
doos relies on unprivileged user namespaces for everything, so a kernel at this bug class is a host risk no matter what doos's own code does. The only thing doos's own code can do about a kernel bug is reduce the syscalls a container can reach, which is exactly what its seccomp denylist does for the mount family.
What the check does
Two independent, non-destructive checks, both required for PASS:
- Kernel version against the fixed table (
uname -r). Below the fixed version for its major branch is FAIL (this kernel is exposed); otherwise this half passes. - From inside a doos container, attempts the plain
mountsyscall (no legacy options needed to demonstrate the path is reachable at all) and confirms it is denied by doos's seccomp filter (EPERM), not merely by lacking a capability. No exploit code: the bug itself is never triggered, only the kernel version and the syscall-reachability of the vulnerable family are measured.
Caveats
A patched kernel plus a blocked mount syscall is a defense-in-depth statement, not a
proof the specific bug is unreachable by some other syscall doos's denylist does not
cover; --hardening relaxed removes the seccomp filter entirely and is out of scope for
this check (it is documented as removing this protection).
Run: make test in this directory, or make -C audit test from the repo root.