A vulnerability (CVE-2022-3910) has been identified in the implementation of the asynchronous I/O interface io_uring, which has been part of the Linux kernel since version 5.1. This flaw allows an unprivileged user to execute code with kernel privileges. The issue appears in versions 5.18 and 5.19 and has been fixed in the 6.0 branch. Debian, RHEL, and SUSE are using kernel releases prior to 5.18, while Fedora, Gentoo, and Arch already offer kernel 6.0. Ubuntu 22.10 utilizes the vulnerable kernel 5.19.
The vulnerability is caused by accessing a freed memory block (use-after-free) in the io_uring subsystem, related to an incorrect update of the reference counter — when invoking io_msg_ring() with a fixed file (constantly present in the ring buffer), the function io_fput_file() is called, erroneously reducing the reference counter.
Source: opennet.ru
