PT-2022-4808 · Linux+5 · Linux Kernel+5
Published
2022-04-07
·
Updated
2023-08-14
·
CVE-2022-3176
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a use-after-free in io uring in the Linux kernel. The
Signalfd poll() and binder poll() functions use a waitqueue whose lifetime is the current task, and it sends a POLLFREE notification to all waiters before the queue is freed. However, the io uring poll does not handle POLLFREE, allowing a use-after-free to occur if a signalfd or binder fd is polled with io uring poll, and the waitqueue gets freed.Recommendations
We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 to resolve the issue. As a temporary workaround, consider disabling the use of
io uring poll with signalfd or binder fd until a patch is available. Restrict access to the vulnerable io uring module to minimize the risk of exploitation. Avoid using the signalfd or binder fd in the affected io uring poll until the issue is resolved.Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Suse
Ubuntu