CVE-2022-0185 — Proof of Concept

A proof-of-concept exploit for CVE-2022-0185, a heap-based buffer overflow in the Linux kernel's legacy_parse_param function (fs/fs_context.c). This allows a local unprivileged user to escalate privileges to root.

Original exploit by Crusaders of Rust. Full writeup: https://www.willsroot.io/2022/01/cve-2022-0185.html

---

Vulnerability

The bug is an integer underflow in the bounds check inside legacy_parse_param(). When the internal buffer size reaches 4095 bytes, the unsigned subtraction wraps around and bypasses the check, enabling an unbounded heap overflow in the kmalloc-4k slab.

Affected kernels: Linux 5.1 – 5.15 Patched in: Linux 5.16+

---

Files

File	Description
exploit_fuse.c	Ubuntu LPE exploit using FUSE + SYSVIPC
exploit_kctf.c	kCTF container escape using pipes + ROP chain
fakefuse.c / .h	Custom FUSE filesystem for race condition
util.c / .h	Shared utilities
libfuse/, libfuse3.a	Statically compiled libfuse (no dl_open)
Makefile	Build script

---

Build

make

---

Usage

Local Privilege Escalation (Ubuntu)

# Enter a user namespace to get CAP_SYS_ADMIN
unshare -Urm

# Run the exploit — makes /bin/bash SUID
./exploit_fuse

# Get a root shell
bash -p

Works on Ubuntu kernels ≥ 5.7. Adjust single_start and modprobe_path offsets in exploit_fuse.c for your kernel version.

kCTF Container Escape

./exploit_kctf

~50% reliability, targeted at Kubernetes 1.22 (kernel 5.10).

---

Disclaimer

For educational and research purposes only. Do not use against systems you do not own or have explicit permission to test.