CVE-2021-3491 Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass

2021-06-0401:40:20

CWE-131

canonical

www.cve.org

linux kernel

max_rw_count bypass

cve-2021-3491

io_uring subsystem

provide buffers

heap overflow

arbitrary code execution

stable kernels

backported

d1f82808877b

ddf0322db79c

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b (“io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers”) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c (“io_uring: add IORING_OP_PROVIDE_BUFFERS”) (v5.7-rc1).

CNA Affected

[
  {
    "product": "Linux kernel",
    "vendor": "Linux",
    "versions": [
      {
        "lessThan": "v5.13-rc4",
        "status": "affected",
        "version": "trunk",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.12.4",
        "status": "affected",
        "version": "linux-5.12.y",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.11.21",
        "status": "affected",
        "version": "linux-5.11.y",
        "versionType": "custom"
      },
      {
        "lessThan": "v5.10.37",
        "status": "affected",
        "version": "linux-5.10.y",
        "versionType": "custom"
      },
      {
        "lessThan": "5.7*",
        "status": "affected",
        "version": "v5.7-rc1",
        "versionType": "custom"
      }
    ]
  }
]