Linux Kernel up to 5.10.160 io_uring io_prep_async_work use after free

Summaryinfo

A vulnerability classified as very critical has been found in Linux Kernel up to 5.10.160. Affected is the function io_prep_async_work of the component io_uring. This manipulation causes use after free. This vulnerability is tracked as CVE-2023-0240. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 5.10.160 (Operating System) and classified as very critical. Affected by this vulnerability is the function io_prep_async_work of the component io_uring. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

The weakness was disclosed 01/30/2023. The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2023-0240 since 01/12/2023. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/30/2023).

Upgrading to version 5.10.161 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.160

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion