CVE-2021-3491: Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass

The iouring subsystem in the Linux kernel allowed the MAXRWCOUNT limit to be bypassed in the PROVIDEBUFFERS operation, which led to negative values being usedin memrw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("iouring: truncate lengths larger than MAXRWCOUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("iouring: add IORINGOPPROVIDEBUFFERS") (v5.7-rc1).

— Launchpad

This vulnerability allows local attackers to escalate privileges on affected installations of Canonical Ubuntu. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of buffers in iouring. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before accessing memory. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

— ZDI