{"id":114696,"date":"2024-04-01T12:25:54","date_gmt":"2024-04-01T10:25:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root"},"modified":"2024-04-01T12:25:54","modified_gmt":"2024-04-01T10:25:54","slug":"uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-podsisteme-io_uring-pozvolyayushhaya-poluchit-privilegii-root","title":{"rendered":"Vulnerability in the io_uring subsystem allows obtaining root privileges","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2024-0582) has been identified in the asynchronous I\/O interface io_uring provided by the Linux kernel, which allows an unprivileged user to gain root rights in the system. Exploiting the vulnerability requires only regular local access to the system, without the need for namespace manipulation. Currently, a working exploit is publicly available, and a second exploitation technique is also detailed. <\/p>\n
The vulnerability is caused by accessing a freed memory block (use-after-free) in the io_uring subsystem, occurring during the registration and deallocation of a ring buffer created with the IORING_REGISTER_PBUF_RING flag. When applying the mmap() operation to the buffer, it remains reflected in user space after the deallocation operation (IORING_UNREGISTER_PBUF_RING) is completed. Using this feature, an attacker can read and write data to memory pages returned by the kernel's memory allocator. <\/p>\n
The issue manifests starting from the release of Linux kernel 6.4 and is fixed in the releases 6.7 and 6.6.5, as well as in the 6.5.0-21 kernel package prepared for Ubuntu 22.04 and 23.10. Notably, the core kernel issue was fixed in December 2023, the Google Zero project disclosed the bug report signaling the vulnerability on January 8, while the fixed kernel package 6.5 for Ubuntu was only formed on February 22, 2024. In other distributions, tracking the fix and vulnerability exposure can be done on the pages of: Debian, Gentoo, RHEL, SUSE, Fedora, Arch. <\/p>\n
The first exploit manipulates the creation of a large number of memory pages controlled by the attacker to determine the memory layout in the kernel and access adjacent physical memory pages, using content from specifically filled network socket structures as beacons. To execute code in the exploit, a \"gadget\" (a sequence of existing instructions in the kernel) is involved, leading to the execution of the function call_usermodehelper_exec, which is designed to run processes in user space from the kernel. <\/p>\n
The second exploit is based on the fact that when all slab blocks in the cache are exhausted (for example, when a file is opened multiple times), free memory pages, to which the attacker has access, are used by the memory allocation system to create a new slab block, and all new file structures begin to be placed in this block. Consequently, some file structures will end up in memory pages that can be read and written by the attacker. The exploitation involves organizing the required file to hit the file cache and replacing the f_mode field in the associated file structures, which determines access rights, allowing a necessary system file, such as \/etc\/passwd, to be writable. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"