CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
21.6%
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b (“io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers”) (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c (“io_uring: add IORING_OP_PROVIDE_BUFFERS”) (v5.7-rc1).
[
{
"product": "Linux kernel",
"vendor": "Linux",
"versions": [
{
"lessThan": "v5.13-rc4",
"status": "affected",
"version": "trunk",
"versionType": "custom"
},
{
"lessThan": "v5.12.4",
"status": "affected",
"version": "linux-5.12.y",
"versionType": "custom"
},
{
"lessThan": "v5.11.21",
"status": "affected",
"version": "linux-5.11.y",
"versionType": "custom"
},
{
"lessThan": "v5.10.37",
"status": "affected",
"version": "linux-5.10.y",
"versionType": "custom"
},
{
"lessThan": "5.7*",
"status": "affected",
"version": "v5.7-rc1",
"versionType": "custom"
}
]
}
]
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
security.netapp.com/advisory/ntap-20210716-0004/
ubuntu.com/security/notices/USN-4949-1
ubuntu.com/security/notices/USN-4950-1
www.openwall.com/lists/oss-security/2021/05/11/13
www.zerodayinitiative.com/advisories/ZDI-21-589/
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
21.6%