CVE-2022-2602
Linux Kernel io_uring Improper Update of Reference Count Privilege Escalation Vulnerability
Severity Score
7.0
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
io_uring UAF, Unix SCM garbage collection
io_uring UAF, recolección de basura Unix SCM
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the io_uring API. The issue results from the improper management of a reference count. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
Linux suffers from an io_uring use-after-free vulnerability due to broken unix GC interaction.
*Credits:
David Bouman, Billy Jheng Bing Jhong working with Trend Micro's Zero Day Initiative
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-08-01 CVE Reserved
- 2022-10-18 CVE Published
- 2022-12-22 First Exploit
- 2024-01-10 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/176533/Linux-Broken-Unix-GC-Interaction-Use-After-Free.html |
|
|
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2602 | Issue Tracking | |
| https://ubuntu.com/security/notices/USN-5691-1 | Third Party Advisory |
|
| https://ubuntu.com/security/notices/USN-5692-1 | Third Party Advisory |
|
| https://ubuntu.com/security/notices/USN-5693-1 | Third Party Advisory |
|
| https://ubuntu.com/security/notices/USN-5700-1 | Third Party Advisory |
|
| https://ubuntu.com/security/notices/USN-5752-1 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/LukeGix/CVE-2022-2602 | 2022-12-22 | |
| https://github.com/kiks7/CVE-2022-2602-Kernel-Exploit | 2023-01-09 | |
| https://github.com/th3-5had0w/CVE-2022-2602-Study | 2023-01-09 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 6.0.19 Search vendor "Linux" for product "Linux Kernel" and version " <= 6.0.19" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | esm |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 22.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "22.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 22.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "22.10" | - |
Affected
| ||||||