There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation.
In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perfUpgrade kernelUpgrade kernel-tools-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.165-143.735Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade python-perf | Feb 7, 2024 | Jan 30, 2023 |
| Debian | — | Upgrade linux | Mar 6, 2023 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Jul 5, 2023 | Jan 30, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub