The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jan 25, 2023 | Jan 11, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libs | May 8, 2023 | Jan 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 11, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub