Headline
CVE-2022-29582: security - Linux: UaF due to concurrency issue in io_uring timeouts
In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
- Products
- Openwall GNU/*/Linux server OS
- Linux Kernel Runtime Guard
- John the Ripper password cracker
- Free & Open Source for any platform
- in the cloud
- Pro for Linux
- Pro for macOS
- Wordlists for password cracking
- passwdqc policy enforcement
- Free & Open Source for Unix
- Pro for Windows (Active Directory)
- yescrypt KDF & password hashing
- yespower Proof-of-Work (PoW)
- crypt_blowfish password hashing
- phpass ditto in PHP
- tcb better password shadowing
- Pluggable Authentication Modules
- scanlogd port scan detector
- popa3d tiny POP3 daemon
- blists web interface to mailing lists
- msulogin single user mode login
- php_mt_seed mt_rand() cracker
- Services
- Publications
- Articles
- Presentations
- Resources
- Mailing lists
- Community wiki
- Source code repositories (GitHub)
- Source code repositories (CVSweb)
- File archive & mirrors
- How to verify digital signatures
- OVE IDs
- What’s new
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Apr 2022 02:43:27 +0200 From: David Bouman <dbouman03@…il.com> To: oss-security@…ts.openwall.com Subject: Linux: UaF due to concurrency issue in io_uring timeouts
Hello list,
We (Jayden Rivers and David Bouman) are disclosing a bug we found in the Linux kernel’s io_uring subsystem. We have written a local privilege escalation PoC that can successfully elevate to system root from an unprivileged process (in a container). We will be releasing a blog post (including exploit code) in a week or two. It should be noted that unlike many Linux vulnerabilities that have surfaced recently, triggering this one does not require an attacker to have any kind of privileges (e.g. in a user namespace). This leaves many systems vulnerable.
We are still looking for a CNA representative that can assign a CVE number for this vulnerability; please contact us!
Kernel versions 5.10+ are affected, and linux-stable patches are already pushed. The upstream patch commit is e677edbcabee849bfdd43f1602bccbecf736a646 (“io_uring: fix race between timeout flush and removal”).
When the IORING_OP_TIMEOUT (T) and IORING_OP_LINK_TIMEOUT (LT) opcodes are combined in a linked submission queue entry, and another request (B) finishes, a race might occur: namely, when due to the completion of B, T is cancelled (through the completion event count), and LT is canceled by its hrtimer at the same time. Whilst T is still being cleaned up, LT is already freed by a different execution context, and since they are linked, the cleanup of T retains a dangling reference to the now-freed LT. Hence, there’s a use-after-free.
Exploitation-wise, the attacker can reallocate LT to another `struct io_kiocb` and defer the UaF to e.g. a `struct file` (this is the technique we will describe in aforementioned blog post).
The race window is quite tight and the scenario is complicated, so the race can only be won very infrequently in our experience.
It is advised to upgrade your kernel to latest ASAP.
Greetings,
Jayden Rivers & David Bouman
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.
Related news
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so ...
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219808546References: Upstream kernel
OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.