2686 matches found
Code injection
iouring UAF, Unix SCM garbage collection...
CVE-2023-1032
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2023-1032
The CVE-2023-1032 issue is a Linux kernel IO_URING IORING_OP_SOCKET double-free in __sys_socket_file() within net/socket.c. It was introduced by commit da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed by commit 649c15c7691e9b13cbe9bf6c65c365350e056067. The connected document set provides concre...
CVE-2023-1032
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2023-1032
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2023-1032
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2023-1032
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2022-2602
CVE-2022-2602 is a Linux kernel vulnerability in io_uring related to a use-after-free in the Unix garbage collection path. Multiple connected sources confirm a local, kernel-side issue (io_uring UAF) that can be exploited to crash the kernel and, in PoC scenarios, enable privilege escalation by r...
CVE-2022-2602
iouring UAF, Unix SCM garbage collection...
CVE-2022-2602
iouring UAF, Unix SCM garbage collection...
CVE-2022-2602
iouring UAF, Unix SCM garbage collection...
CVE-2022-2602
iouring UAF, Unix SCM garbage collection...
Linux 6.4 io_uring Use-After-Free
Linux =6.4: iouring: page UAF via buffer ring mmap Since commit c56e022c0a27 "iouring: add support for user mapped provided buffer ring", landed in Linux 6.4, iouring makes it possible to allocate, mmap, and deallocate "buffer rings". A "buffer ring" can be allocated with iouringregister...,...
Linux io_uring __io_uaddr_map() Dangerous Multi-Page Handling Exploit
iouring: iouaddrmap handles multi-page region dangerously iouaddrmap wants to import a region from userspace, and then address the imported region through the linear mapping area. This requires that the imported region is physically contiguous. A comment in iouaddrmap explains that the imported...
CVE-2023-1032: Double Free
The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...
CVE-2022-2602: Use After Free
iouring UAF, Unix SCM garbage collection...
Linux 6.4 io_uring Use-After-Free Exploit
Linux =6.4: iouring: page UAF via buffer ring mmap Since commit c56e022c0a27 "iouring: add support for user mapped provided buffer ring", landed in Linux 6.4, iouring makes it possible to allocate, mmap, and deallocate "buffer rings". A "buffer ring" can be allocated with iouringregister...,...
io_uring __io_uaddr_map() Dangerous Multi-Page Handling
iouring: iouaddrmap handles multi-page region dangerously iouaddrmap wants to import a region from userspace, and then address the imported region through the linear mapping area. This requires that the imported region is physically contiguous. A comment in iouaddrmap explains that the imported...
Kernel: io_uring out of boundary memory access in __io_uaddr_map()
...
Linux kernel io_uring Privilege Escalation
The vulnerability of the iouring subsystem in Linux kernel relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...