CVE-2023-21400

Published: 13 July 2023

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.

From the Ubuntu Security Team

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Priority reason:
Unprivileged users may use io_uring to potentially escalate privilege.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21400
• https://source.android.com/security/bulletin/pixel/2023-07-01
• https://yanglingxi1993.github.io/dirty_pagetable/dirty_pagetable.html
• https://www.openwall.com/lists/oss-security/2023/07/14/2
• https://www.openwall.com/lists/oss-security/2023/07/25/9
• https://twitter.com/VAR10CK/status/1683303642173153280
• https://ubuntu.com/security/notices/USN-6315-1
• https://ubuntu.com/security/notices/USN-6325-1
• https://ubuntu.com/security/notices/USN-6330-1
• https://ubuntu.com/security/notices/USN-6332-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2222087
• https://bugzilla.suse.com/show_bug.cgi?id=1213272