CVE-2022-3910
Use after free in IO_uring in the Linux Kernel
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation.
When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately.
We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679
La vulnerabilidad de Use After Free en el kernel de Linux permite la escalada de privilegios. Una actualización incorrecta del recuento de referencias en io_uring conduce a un use-after-free y escalada de privilegios locales. Cuando se invocó io_msg_ring con un archivo fijo, llamó a io_fput_file(), lo que disminuyó incorrectamente su recuento de referencias (lo que llevó a Use-After-Free y Escalada de privilegios locales). Los archivos fijos están registrados permanentemente en el anillo y no deben colocarse por separado. Recomendamos actualizar el commit anteriorhttps://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-11-09 CVE Reserved
- 2022-11-22 CVE Published
- 2023-03-14 First Exploit
- 2024-02-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
- CAPEC-233: Privilege Escalation
References (4)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/veritas501/CVE-2022-3910 | 2023-03-14 | |
| https://github.com/TLD1027/CVE-2022-3910 | 2024-07-26 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 | 2023-11-07 | |
| https://kernel.dance/#fc7222c3a9f56271fba02aabbfbae999042f1679 | 2023-11-07 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.18 < 5.19.11 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.18 < 5.19.11" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.0 Search vendor "Linux" for product "Linux Kernel" and version "6.0" | rc1 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.0 Search vendor "Linux" for product "Linux Kernel" and version "6.0" | rc2 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.0 Search vendor "Linux" for product "Linux Kernel" and version "6.0" | rc3 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.0 Search vendor "Linux" for product "Linux Kernel" and version "6.0" | rc4 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 6.0 Search vendor "Linux" for product "Linux Kernel" and version "6.0" | rc5 |
Affected
| ||||||