{"id":105336,"date":"2022-10-19T15:37:24","date_gmt":"2022-10-19T13:37:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme"},"modified":"2022-10-19T15:37:24","modified_gmt":"2022-10-19T13:37:24","slug":"uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-podsisteme-io_uring-yadra-linux-pozvolyayushhaya-povysit-privilegii-v-sisteme","title":{"rendered":"Vulnerability in the io_uring subsystem of the Linux kernel that allows privilege escalation in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2022-2602) has been identified in the implementation of the asynchronous I\/O interface io_uring, which is part of the Linux kernel since release 5.1, allowing an unprivileged user to gain root access. The issue has been confirmed in branch 5.4 and in kernels starting from branch 5.15. <\/p>\n
The vulnerability is caused by accessing a freed memory block (use-after-free) in the io_uring subsystem, which occurs due to a race condition while processing an io_uring request on a target file during garbage collection for Unix sockets, if the garbage collector frees all registered file descriptors and the file descriptor that io_uring is working with. To artificially create the conditions for this vulnerability, one can delay the request using userfaultfd until the memory is freed by the garbage collector. <\/p>\n
The researchers who discovered the issue have announced the creation of a working exploit, which they plan to release on October 25, to give users time to install updates. A fix is currently available as a patch. Updates for distributions have not yet been released, but they can be tracked on the following pages: Debian, Ubuntu, Gentoo, RHEL, Fedora, SUSE\/openSUSE, Arch. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"