A Linux kernel vulnerability (CVE-2021-41073) has been identified, allowing a local user to elevate their privileges in the system. The issue arises from a flaw in the implementation of the io_uring asynchronous I/O interface, leading to access to already freed memory blocks. It has been noted that the researcher was able to achieve memory release at a specified offset while manipulating the loop_rw_iter() function as an unprivileged user, making it possible to create a working exploit. Currently, the issue has only been addressed in the form of a patch that has been backported into the stable kernel branches, but an update has not yet been released.
Forrás: opennet.ru
