PT-2022-15230 · Nio Uring · Nio Uring

Published 2022-07-22 · Updated 2022-11-09 · CVE-2022-2209

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions nio uring versions prior to commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859

Description The issue arises from an incomplete mapping of flags in nio uring, leading to incorrect reference counts and resulting in use-after-free errors. This occurs when nio uring attempts to ensure consistency with the calling process during the execution of IORING OP by using work flags to determine which identity to grab from the calling process.

Recommendations For versions prior to commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859, upgrade past this commit to resolve the issue.

Related Identifiers

CVE-2022-2209

Affected Products

Nio Uring

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2209 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-2209 · Security Note
• https://ubuntu.com/security/CVE-2022-2209 · Vendor Advisory
• https://github.com/torvalds/linux/commit/df3f3bb5059d20ef094d6b2f0256c4bf4127a859 · Note
• https://t.me/true_secator/3677 · Telegram Post
• https://t.me/cvenotify/33602 · Telegram Post
• https://t.me/cibsecurity/46786 · Telegram Post
• https://kernel.dance/#df3f3bb5059d20ef094d6b2f0256c4bf4127a859 · Note
• https://t.me/cvenotify/33598 · Telegram Post