CVE-2022-29582: Linux kernel use-after-free vulnerability in io_uring timeouts
Summary
CVE-2022-29582: In fs, there is a possible use-after-free due to a race condition in io_uring timeouts. Affects :linux_kernel: versions >= :0, < :2022-09-05. Fixed in :2022-09-05. How to fix ↓
Also tracked for
- linux · Debian:11
The same CVE-2022-29582 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions, including Android. It provides core functionality and interfaces for system resources, such as file systems. The io_uring subsystem is a high-performance interface for asynchronous I/O operations. It allows applications to submit I/O requests and receive completion notifications without blocking the execution flow. However, a vulnerability has been discovered in the Linux kernel's fs component, specifically in the handling of io_uring timeouts.
Vulnerability Detail
The vulnerability arises due to a race condition in io_uring timeouts, leading to a use-after-free scenario. An attacker with local access to the affected system can exploit this vulnerability to escalate their privileges without requiring additional execution privileges. The exploitation does not require any user interaction. This vulnerability has a high severity rating and can potentially result in unauthorized privilege escalation.
How To Fix
Minimum fixed version
:2022-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the official fix by updating the Linux kernel to the patched version.
Conclusion
In conclusion, a use-after-free vulnerability has been discovered in the Linux kernel's handling of io_uring timeouts. This vulnerability allows a local attacker to escalate their privileges without requiring additional execution privileges. It is recommended to update the Linux kernel to the latest patched version to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
This vulnerability allows a local attacker to escalate their privileges on the affected system, potentially gaining unauthorized access to sensitive resources and compromising the system's security.
No, user interaction is not required for the exploitation of this vulnerability.
This vulnerability affects systems running the Linux kernel, including Android devices.
As of the publication date, there is no known public exploit for this vulnerability.
To protect your system, it is crucial to update the Linux kernel to a version that includes the fix for this vulnerability. Regularly applying security updates and patches is essential for maintaining the security of your system.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
