A vulnerability has been identified in the Linux kernel (CVE-2022-2590) that allows an unprivileged user to modify memory-mapped files (mmap) and files in tmpfs without having write permissions, thereby elevating their privileges within the system. This issue is reminiscent of the Dirty COW vulnerability, but it is limited to impacting data in shared memory (shmem / tmpfs). The problem can also be exploited to modify running executable files that utilize shared memory.
The issue is caused by a race condition in the memory management subsystem that occurs while processing an exception (fault) triggered by an attempt to write to read-only areas in shared memory that are mapped in COW (copy-on-write mapping). The vulnerability manifests starting from kernel version 5.16 on x86-64 and aarch64 systems with the kernel built with the CONFIG_USERFAULTFD=y option. The vulnerability has been fixed in the 5.19 release. An example exploit is planned to be published on August 15.
Source: opennet.ru
