A vulnerability (CVE-2022-29582) has been identified in the implementation of the asynchronous input/output interface io_uring, which has been included in the Linux kernel since version 5.1. This allows an unprivileged user to gain root privileges in the system, including by running an exploit from a container. The vulnerability is caused by accessing a previously freed memory block and manifests in Linux kernels starting from branch 5.10, having been patched in April with updates 5.10.111, 5.15.34, and 5.17.3.
The access to freed memory occurs due to a race condition when handling timeouts in the io_flush_timeouts() function, which removes the timeout entry from the list and cancels it without checking the creation and deletion of the timeout at that moment.
Researchers have developed a working exploit that does not require user namespaces to be enabled and can provide root access to the host system when the exploit is run by an unprivileged user in an isolated container. The exploit also works in the isolated environment nsjail in the Google COS (Container Optimized OS) distribution, which is based on Chromium OS and used in Google Cloud Platform's Compute Engine. The exploit is designed to work with kernel branches from 5.10 to 5.12. virtual machines NetBSD 9.3 release
Source: opennet.ru
