PT-2021-7639 · Linux+1 · Linux Kernel+1

Published 2020-12-18 · Updated 2023-03-10 · CVE-2023-0240

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.161

Description The issue is related to a logic error in the io uring implementation, which can trigger a use-after-free vulnerability leading to privilege escalation. In the io prep async work function, the assumption that the last io grab identity call cannot return false is not true. If it does return false, the function will use the init cred or the previous linked requests identity to do operations instead of using the current identity, leading to reference counting issues and use-after-free.

Recommendations To resolve the issue, upgrade past version 5.10.161.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-3536

ALT-PU-2020-3553

ALT-PU-2020-3571

ALT-PU-2021-1083

ALT-PU-2021-1105

ALT-PU-2021-1446

ALT-PU-2021-1621

ALT-PU-2021-1656

ALT-PU-2021-1739

ALT-PU-2021-1862

ALT-PU-2021-1866

ALT-PU-2021-1870

BDU:2023-00628

CVE-2023-0240

DLA-3349-1

OESA-2023-1144

OESA-2023-1157

Affected Products

Alt Linux

Linux Kernel

References · 28

• https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-0240 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&id=788d0824269bef539fe31a785b1517882eafed93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33639 · Security Note
• https://osv.dev/vulnerability/DLA-3349-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0240 · Vendor Advisory
• https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-0615 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0045 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23586 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-0240 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1157 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-0240 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00628 · Security Note