A vulnerability (CVE-2022-29582) has been identified in the implementation of the io_uring asynchronous input/output interface, included in the Linux kernel since version 5.1, enabling an unprivileged user to gain root access to the system, even when launching an exploit from a container. This vulnerability arises from accessing a freed memory block and is present in Linux kernels starting from branch 5.10, with fixes released in April in updates 5.10.111, 5.15.34, and 5.17.3.
Accessing freed memory occurs due to a race condition when processing timeouts in the io_flush_timeouts() function, which removes the timeout entry from the list and cancels it without checking if the timeout has been created or deleted at that moment.
Researchers have developed a working exploit that does not require enabling user namespace support and can grant root access to the main system when an unprivileged user launches the exploit from an isolated container. The exploit also works in the isolated nsjail environment within the Google COS (Container Optimized OS) distribution based on Chromium OS, used in Google Cloud Platform. virtualnim mašinama Compute Engine. The exploit is designed to work with kernel branches from 5.10 to 5.12.
Izvor: opennet.ru
