CVE-2022-3176
Use-after-free in io_uring in Linux Kernel
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
Se presenta un uso de memoria previamente liberada en la función io_uring en el kernel de Linux. Signalfd_poll() y binder_poll() usan una cola de espera cuyo tiempo de vida es la tarea actual. Enviará una notificación POLLFREE a todos los esperadores antes de que la cola sea liberada. Desafortunadamente, el sondeo io_uring no maneja POLLFREE. Esto permite que sea producido un uso de memoria previamente liberada si un signalfd o binder fd es sondeado con io_uring poll, y la cola de espera es liberada. Recomendamos actualizar el commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-12 CVE Reserved
- 2022-09-16 CVE Published
- 2023-12-22 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20230216-0003 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2022/dsa-5257 | 2023-04-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.1 < 5.4.212 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.1 < 5.4.212" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.5 < 5.10.141 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.5 < 5.10.141" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.11 < 5.15.65 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.11 < 5.15.65" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.16 < 5.17 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.16 < 5.17" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||