The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade perfUpgrade kernelUpgrade python-perfUpgrade kernel-tools | Jul 4, 2022 | Jun 4, 2021 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 4, 2021 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-rt_debugUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-preemptUpgrade kernel-sourceUpgrade cluster-md-kmp-rt_debugUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade kernel-rtUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rt_debugUpgrade kselftests-kmp-64kbUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kernel-source-azureUpgrade ocfs2-kmp-preemptUpgrade dlm-kmp-64kbUpgrade kernel-preemptUpgrade kernel-default-manUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rt_debugUpgrade kernel-azure-livepatch-develUpgrade kernel-rt_debug-extraUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-rt_debugUpgrade kernel-preempt-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-default-livepatch-develUpgrade kernel-azure-baseUpgrade kselftests-kmp-preemptUpgrade kernel-azureUpgrade kernel-develUpgrade kernel-azure-extraUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-preempt-optionalUpgrade cluster-md-kmp-preemptUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-vanilla-baseUpgrade kernel-debug-develUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-rt_debugUpgrade kernel-debugUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-preemptUpgrade kernel-rt-extraUpgrade dlm-kmp-preemptUpgrade kselftests-kmp-azureUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade kernel-source-rtUpgrade kernel-preempt-extraUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade kernel-preempt-develUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rt_debugUpgrade kernel-obs-build | Jun 7, 2021 | May 11, 2021 |
| Ubuntu | — | Upgrade linux-image-5.11.0-1007-kvmUpgrade linux-image-5.11.0-1005-azureUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.8.0-1029-oracleUpgrade linux-image-oem-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.8.0-1033-awsUpgrade linux-image-5.8.0-53-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.11.0-17-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-5.11.0-1007-awsUpgrade linux-image-5.11.0-1006-oracleUpgrade linux-image-5.11.0-17-generic-64kUpgrade linux-image-gcpUpgrade linux-image-awsUpgrade linux-image-lowlatencyUpgrade linux-image-5.11.0-17-genericUpgrade linux-image-5.8.0-53-generic-lpaeUpgrade linux-image-5.8.0-1032-azureUpgrade linux-image-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-5.10.0-1026-oemUpgrade linux-image-5.11.0-1008-raspi-nolpaeUpgrade linux-image-5.11.0-1007-gcpUpgrade linux-image-5.8.0-1031-gcpUpgrade linux-image-5.8.0-1024-raspi-nolpaeUpgrade linux-image-kvmUpgrade linux-image-5.11.0-1008-raspiUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.8.0-1024-raspiUpgrade linux-image-5.8.0-1027-kvmUpgrade linux-image-raspiUpgrade linux-image-5.11.0-17-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.8.0-53-generic-64kUpgrade linux-image-5.8.0-53-generic | May 12, 2021 | May 11, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub