Linux io_uring Heap Buffer Overflow DoS

The vulnerability of the fs/iouring.c file in the iouring subsystem of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure or increase their privileges...

In the Linux kernel before 5.17.3 fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however the race condition perhaps can only be exploited infrequently.

...

CVE-2022-29968

An issue was discovered in the Linux kernel through 5.17.5. iorwinitfile in fs/iouring.c lacks initialization of kiocb-private...

DEBIAN-CVE-2022-29968

An issue was discovered in the Linux kernel through 5.17.5. iorwinitfile in fs/iouring.c lacks initialization of kiocb-private...

UBUNTU-CVE-2022-29968

An issue was discovered in the Linux kernel through 5.17.5. iorwinitfile in fs/iouring.c lacks initialization of kiocb-private...

CVE-2022-29968

An issue was discovered in the Linux kernel through 5.17.5. iorwinitfile in fs/iouring.c lacks initialization of kiocb-private...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel version 5.17.5 and prior versions have a security vulnerability that stems from a missing initialization of kiocb-private in iorwinitfile in fs/iouring.c. No detailed vulnerability details a...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.35 and fixes at least the following security issues: A denial of service DOS issue was found in the Linux kernel smb2ioctlqueryinfo function in the fs/cifs/smb2ops.c Common Internet File System CIFS due to an incorrect return from the memdupuser...

CVE-2022-1508

An out-of-bounds read flaw was found in the Linux kernel’s iouring module in the way a user triggers the ioread function with some special parameters. This flaw allows a local user to read some memory out of bounds...

CVE-2022-29582

A use-after-free flaw was found in the Linux kernel’s iouring interface subsystem in the way a user triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or escalate their privileges on the system...

GSD-2022-1002022 io_uring: fix memory leak of uid in files registration

iouring: fix memory leak of uid in files registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.110 by commit...

GSD-2022-1001751 io_uring: fix memory leak of uid in files registration

iouring: fix memory leak of uid in files registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001427 io_uring: fix memory leak of uid in files registration

iouring: fix memory leak of uid in files registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001102 io_uring: bump poll refs to full 31-bits

iouring: bump poll refs to full 31-bits This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1001099 io_uring: fix memory leak of uid in files registration

iouring: fix memory leak of uid in files registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1000994 io_uring: drop the old style inflight file tracking

iouring: drop the old style inflight file tracking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.3 by commit...

GSD-2022-1000975 io_uring: abort file assignment prior to assigning creds

iouring: abort file assignment prior to assigning creds This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.4 by commit...

PT-2022-29372

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.5 through v5.17.1 Description A memory leak issue was discovered in the io uring files registration, which could potentially lead to security vulnerabilities. The issue was introduced in version v5.5 and is fixed in...

CVE-2022-29582

In the Linux kernel before 5.17.3, fs/iouring.c has a use-after-free due to a race condition in iouring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently...

CVE-2022-29582

In the Linux kernel before 5.17.3, fs/iouring.c has a use-after-free due to a race condition in iouring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently...