A Linux kernel vulnerability (CVE-2022-3910) has been identified in the implementation of the io_uring asynchronous I/O interface, which has been included since version 5.1. This vulnerability allows an unprivileged user to execute code with kernel privileges. The issue appears in versions 5.18 and 5.19, and has been resolved in the 6.0 branch. Debian, RHEL, and SUSE are using kernel releases prior to 5.18, while Fedora, Gentoo, and Arch already offer kernel 6.0. Ubuntu 22.10 is using the vulnerable kernel 5.19.
The vulnerability is caused by accessing a previously freed memory block (use-after-free) in the io_uring subsystem, related to the incorrect update of the reference counter — when calling io_msg_ring() with a fixed file (permanently in the ring buffer), it inadvertently calls the io_fput_file() function, which mistakenly decrements the reference counter.
Forrás: opennet.ru
