[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 8 Aug 2022 13:07:13 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: David Bouman <dbouman03@...il.com>
Subject: Re: Linux: UaF due to concurrency issue in io_uring timeouts
Hi,
Jayden and David have recently published a lengthy write-up on this
vulnerability, here:
https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/
and exploit here:
https://github.com/Ruia-ruia/CVE-2022-29582-Exploit
Alexander
On Fri, Apr 22, 2022 at 06:02:58PM +0200, Salvatore Bonaccorso wrote:
> Hi David,
>
> On Fri, Apr 22, 2022 at 02:43:27AM +0200, David Bouman wrote:
> > Hello list,
> >
> > We (Jayden Rivers and David Bouman) are disclosing a bug we found in the
> > Linux kernel's io_uring subsystem. We have written a local privilege
> > escalation PoC that can successfully elevate to system root from an
> > unprivileged process (in a container). We will be releasing a blog post
> > (including exploit code) in a week or two. It should be noted that unlike
> > many Linux vulnerabilities that have surfaced recently, triggering this one
> > does not require an attacker to have any kind of privileges (e.g. in a user
> > namespace). This leaves many systems vulnerable.
> >
> > We are still looking for a CNA representative that can assign a CVE number
> > for this vulnerability; please contact us!
> >
> > Kernel versions 5.10+ are affected, and linux-stable patches are already
> > pushed. The upstream patch commit is
> > e677edbcabee849bfdd43f1602bccbecf736a646 ("io_uring: fix race between
> > timeout flush and removal").
> >
> > When the IORING_OP_TIMEOUT (T) and IORING_OP_LINK_TIMEOUT (LT) opcodes are
> > combined in a linked submission queue entry, and another request (B)
> > finishes, a race might occur: namely, when due to the completion of B, T is
> > cancelled (through the completion event count), and LT is canceled by its
> > hrtimer at the same time. Whilst T is still being cleaned up, LT is already
> > freed by a different execution context, and since they are linked, the
> > cleanup of T retains a dangling reference to the now-freed LT. Hence,
> > there's a use-after-free.
> >
> > Exploitation-wise, the attacker can reallocate LT to another `struct
> > io_kiocb` and defer the UaF to e.g. a `struct file` (this is the technique
> > we will describe in aforementioned blog post).
> >
> > The race window is quite tight and the scenario is complicated, so the race
> > can only be won very infrequently in our experience.
> >
> > It is advised to upgrade your kernel to latest ASAP.
> >
> > Greetings,
> >
> > Jayden Rivers & David Bouman
>
> This has CVE-2022-29582 assigned.
>
> https://www.cve.org/CVERecord?id=CVE-2022-29582
>
> Regards,
> Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
