7.8
Élevée
CVE-2023-0240 There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability…
Description
There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux Kernel 5.10 | 5.10 → 5.10.161 | Pas de correctif indiqué |
| linux_kernel 5.10 | 5.10 → 5.10.161 | Pas de correctif indiqué |
Références
- git.kernel.org git.kernel.org
- github.com github.com
- kernel.dance kernel.dance
Chronologie
- Publiée
- Dernière modification
Autres CVE de Linux Kernel
Les 43 CVE de Linux Kernel →
CVE-2024-24864
A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function
5.3
Moyenne
CVE-2024-24857
A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function
4.6
Moyenne
CVE-2024-24858
A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function
4.6
Moyenne
CVE-2024-24859
A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function
4.6
Moyenne