Company
Date Published
Author
Itay Vaknin, Threat Intelligence Researcher
Word count
1116
Language
English
Hacker News points
None

Summary

CVE-2022-0185 is a critical vulnerability in Linux kernel versions 5.1 to 5.16.1, caused by an integer underflow in the Filesystem Context module, which can lead to privilege escalation, container environment escape, or denial of service. Discovered through Google's KCTF bug bounty program, it allows a local attacker to execute arbitrary code in the kernel context. The vulnerability's exploitation requires the CAP_SYS_ADMIN capability, often available in Kubernetes environments, making it particularly concerning for self-managed deployments like Amazon EKS, Azure AKS, and Google GKE. While some Kubernetes engines have released updates to mitigate the issue, others like GKE are still pending fixes. To remediate outside Kubernetes, upgrading to Linux kernel version 5.16.2 or applying a patch is advised, alongside limiting privileged containers and disabling unprivileged user namespaces as a mitigation strategy. With exploitation methods already published, this vulnerability poses a significant threat, and staying updated with security patches and advisories is crucial for affected systems.