A vulnerability (CVE-2022-29582) has been identified in the implementation of the io_uring asynchronous I/O interface, which is part of the Linux kernel starting from version 5.1. This vulnerability allows an unprivileged user to gain root access to the system, including when running an exploit from a container. The vulnerability is caused by accessing already freed memory, manifesting in Linux kernels starting from branch 5.10, and was fixed in April in updates 5.10.111, 5.15.34, and 5.17.3.
Accessing freed memory occurs due to a race condition during timeout handling in the io_flush_timeouts() function, which removes the timeout record from the list and cancels it without checking the creation and deletion of the timeout at that moment.
Researchers have prepared a working exploit that does not require enabling user namespace isolation and can provide root access to the main system when run by an unprivileged user in an isolated container. The exploit also works in the isolated nsjail environment in the Google COS (Container Optimized OS) distribution, based on Chromium OS and used in Google Cloud Platform. virtuális gépekben Compute Engine. The exploit is designed to work with kernel branches from 5.10 to 5.12.
Forrás: opennet.ru
