PT-2021-1528 · Linux+2 · Linux Kernel+2
Published
2021-02-21
·
Updated
2023-05-17
·
CVE-2022-4696
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.10.160
Description
The issue is related to a use-after-free vulnerability in the Linux kernel through io uring and the IORING OP SPLICE operation. If IORING OP SPLICE is missing the IO WQ WORK FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io splice on specific files will call the get uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability.
Recommendations
To resolve the issue, upgrade to version 5.10.160 or above. As a temporary workaround, consider restricting access to the io uring subsystem and the IORING OP SPLICE operation to minimize the risk of exploitation. Avoid using the
IO WQ WORK FILES flag in the IORING OP SPLICE operation until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linux Kernel