CVE-2022-29582: security - Linux: UaF due to concurrency issue in io_uring timeouts

• Products
  • Openwall GNU/*/Linux server OS
  • Linux Kernel Runtime Guard
  • John the Ripper password cracker
    • Free & Open Source for any platform
    • in the cloud
    • Pro for Linux
    • Pro for macOS
  • Wordlists for password cracking
  • passwdqc policy enforcement
    • Free & Open Source for Unix
    • Pro for Windows (Active Directory)
  • yescrypt KDF & password hashing
  • yespower Proof-of-Work (PoW)
  • crypt_blowfish password hashing
  • phpass ditto in PHP
  • tcb better password shadowing
  • Pluggable Authentication Modules
  • scanlogd port scan detector
  • popa3d tiny POP3 daemon
  • blists web interface to mailing lists
  • msulogin single user mode login
  • php_mt_seed mt_rand() cracker
• Services
• Publications
  • Articles
  • Presentations
• Resources
  • Mailing lists
  • Community wiki
  • Source code repositories (GitHub)
  • Source code repositories (CVSweb)
  • File archive & mirrors
  • How to verify digital signatures
  • OVE IDs
• What’s new

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 22 Apr 2022 02:43:27 +0200 From: David Bouman <dbouman03@…il.com> To: oss-security@…ts.openwall.com Subject: Linux: UaF due to concurrency issue in io_uring timeouts

Hello list,

We (Jayden Rivers and David Bouman) are disclosing a bug we found in the Linux kernel’s io_uring subsystem. We have written a local privilege escalation PoC that can successfully elevate to system root from an unprivileged process (in a container). We will be releasing a blog post (including exploit code) in a week or two. It should be noted that unlike many Linux vulnerabilities that have surfaced recently, triggering this one does not require an attacker to have any kind of privileges (e.g. in a user namespace). This leaves many systems vulnerable.

We are still looking for a CNA representative that can assign a CVE number for this vulnerability; please contact us!

Kernel versions 5.10+ are affected, and linux-stable patches are already pushed. The upstream patch commit is e677edbcabee849bfdd43f1602bccbecf736a646 (“io_uring: fix race between timeout flush and removal”).

When the IORING_OP_TIMEOUT (T) and IORING_OP_LINK_TIMEOUT (LT) opcodes are combined in a linked submission queue entry, and another request (B) finishes, a race might occur: namely, when due to the completion of B, T is cancelled (through the completion event count), and LT is canceled by its hrtimer at the same time. Whilst T is still being cleaned up, LT is already freed by a different execution context, and since they are linked, the cleanup of T retains a dangling reference to the now-freed LT. Hence, there’s a use-after-free.

Exploitation-wise, the attacker can reallocate LT to another `struct io_kiocb` and defer the UaF to e.g. a `struct file` (this is the technique we will describe in aforementioned blog post).

The race window is quite tight and the scenario is complicated, so the race can only be won very infrequently in our experience.

It is advised to upgrade your kernel to latest ASAP.

Greetings,

Jayden Rivers & David Bouman

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.