I implementation of the asynchronous I/O interface io_uring, included in the Linux kernel since version 5.1, a vulnerability (CVE-2022-29582) has been identified that allows an unprivileged user to gain root privileges on the system, including when launching the exploit from a container. The vulnerability is caused by accessing a previously freed memory block and manifests in Linux kernels starting from version 5.10, and was fixed in April in updates 5.10.111, 5.15.34, and 5.17.3.
Accessing freed memory occurs as a result of a race condition when handling timeouts in the function io_flush_timeouts(), which removes the timeout entry from the list and cancels it, without checking for the creation and deletion of the timeout at that moment.
Researchers have prepared a working exploit that does not require enabling user namespace support and can provide root access to the main system when the exploit is run by an unprivileged user in an isolated container. The exploit also works in the isolated environment nsjail in the Google COS (Container Optimized OS) distribution, based on Chromium OS and used in Google Cloud Platform. virtuella maskiner Compute Engine. The exploit is designed to work with kernel branches from 5.10 to 5.12.
KĂ€lla: opennet.ru
