Description
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Kernel
Default version status: unaffected
5.13 to < 6.4affected5.10.162 to < 5.10.185affected
References
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=0e388fce7aec40992eadee654193cad345d62663 ↗
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=4716c73b188566865bdd79c3a6709696a224ac04 ↗
- https://kernel.dance/0e388fce7aec40992eadee654193cad345d62663 ↗
- https://kernel.dance/4716c73b188566865bdd79c3a6709696a224ac04 ↗
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef7dfac51d8ed961b742218f526bd589f3900a59 ↗
- https://kernel.dance/ef7dfac51d8ed961b742218f526bd589f3900a59 ↗
- https://security.netapp.com/advisory/ntap-20230731-0001/ ↗
- https://www.debian.org/security/2023/dsa-5480 ↗
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html ↗
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html ↗