Updated: 2024-11-30 03:34:28.717791
Description:
There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | 0 | |
| CVSS Version 3.x | HIGH | 7.8 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| CentOS 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-04-12 08:49:45 | ||
| CentOS 7 ELS | kernel | 3.10.0 | 7.8 | HIGH | Not Vulnerable | 2023-11-02 14:11:47 | ||
| CentOS 8.4 ELS | kernel | 4.18.0 | 7.8 | HIGH | Not Vulnerable | 2023-04-28 03:35:03 | ||
| CentOS 8.5 ELS | kernel | 4.18.0 | 7.8 | HIGH | Not Vulnerable | 2023-04-13 11:06:21 | ||
| CloudLinux 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-04-12 08:49:45 | ||
| Oracle Linux 6 ELS | kernel | 2.6.32 | 7.8 | HIGH | Not Vulnerable | 2023-04-12 08:49:45 | ||
| Ubuntu 16.04 ELS | linux | 4.4.0 | 7.8 | HIGH | Not Vulnerable | 2023-02-23 07:39:30 | ||
| Ubuntu 16.04 ELS | linux-hwe | 4.15.0 | 7.8 | HIGH | Not Vulnerable | 2023-02-28 13:04:39 | ||
| Ubuntu 18.04 ELS | linux | 4.15.0 | 7.8 | HIGH | Not Vulnerable | 2023-08-28 21:18:32 |