oss-security - Linux kernel: io_uring: free of unallocated buffer list in io_register_pbuf

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220808112020.GA18620@openwall.com>
Date: Mon, 8 Aug 2022 13:20:20 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Dipanjan Das <mail.dipanjan.das@...il.com>,
	Dylan Yudaken <dylany@...com>, Jens Axboe <axboe@...nel.dk>
Subject: Linux kernel: io_uring: free of unallocated buffer list in io_register_pbuf_ring()

Hi,

I think this wasn't reported in here before, and has no CVE ID?

Writeup in Chinese dated July 29:

https://dawnslab.jd.com/linux-5.19-rc2_pbuf_ring_0day/

Fix dated July 21, per the writeup included in 5.19-rc8:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec8516f3b7c40ba7050e6b3a32467e9de451ecdf

Per the Fixes tag, the bug was introduced in May, in:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c7fb19428d67

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.