CVE-2022-1011: Use After Free

First published: Mon Mar 07 2022(Updated: )

A flaw in the Linux Kernel found. If unprivileged users can mount FUSE filesystems, then can trigger use after free (UAF) that reads of write() buffers, allowing theft of (partial) /etc/shadow hashes or any other data from filesystem. FUSE allows the userspace filesystem to specify on FUSE_OPEN whether the file should use the normal kernel pagecache for handling read()/write() or just send FUSE_READ/FUSE_WRITE requests directly to the userspace filesystem (using the flag FOPEN_DIRECT_IO in fuse_open_out::open_flags). In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then imports the write buffer with fuse_get_user_pages(), which uses iov_iter_get_pages() to grab references to userspace pages instead of actually copying memory. On the filesystem device side, these pages can then either be read to userspace (via fuse_dev_read()), or splice()d over into a pipe using fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops. This is wrong because after fuse_dev_do_read() unlocks the FUSE request, the userspace filesystem can mark the request as completed, causing write() to return. At that point, the write buffer may be reused for other purposes, and the userspace filesystem should no longer have access to it.

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• agent/type
• collector/launchpad-cve
• source/Launchpad
• agent/first-publish-date
• agent/author
• agent/severity
• agent/weakness
• collector/nvd-index
• agent/software-canonical-lookup-request
• collector/mitre-cve
• source/MITRE
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2022-1011
• agent/software-canonical-lookup
• collector/usn-cve
• source/Ubuntu
• collector/nvd-cve
• source/NVD
• collector/security-tracker-debian
• source/Debian
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/tags
• agent/description
• agent/softwarecombine
• agent/event
• agent/trending
• package-manager/redhat
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/5.17
• version/linux linux kernel/5.17-rc1
• version/linux linux kernel/5.17-rc2
• version/linux linux kernel/5.17-rc3
• version/linux linux kernel/5.17-rc4
• version/linux linux kernel/5.17-rc7
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/34
• version/fedoraproject fedora/35
• vendor/redhat
• canonical/redhat build of quarkus
• version/redhat build of quarkus/2.0
• canonical/redhat developer tools
• version/redhat developer tools/1.0
• canonical/redhat enterprise linux
• version/redhat enterprise linux/6.0
• version/redhat enterprise linux/7.0
• version/redhat enterprise linux/8.0
• canonical/redhat enterprise linux eus
• version/redhat enterprise linux eus/8.6
• canonical/redhat enterprise linux for ibm z systems
• version/redhat enterprise linux for ibm z systems/8.0
• canonical/redhat enterprise linux for ibm z systems eus
• version/redhat enterprise linux for ibm z systems eus/8.6
• canonical/redhat enterprise linux for power little endian
• version/redhat enterprise linux for power little endian/8.0
• canonical/redhat enterprise linux for power little endian eus
• version/redhat enterprise linux for power little endian eus/8.6
• canonical/redhat enterprise linux for real time
• version/redhat enterprise linux for real time/8
• canonical/redhat enterprise linux for real time for nfv
• version/redhat enterprise linux for real time for nfv/8
• canonical/redhat enterprise linux for real time for nfv tus
• version/redhat enterprise linux for real time for nfv tus/8.6
• canonical/redhat enterprise linux for real time tus
• version/redhat enterprise linux for real time tus/8.6
• canonical/redhat enterprise linux server aus
• version/redhat enterprise linux server aus/8.6
• canonical/redhat enterprise linux server for power little endian update services for sap solutions
• version/redhat enterprise linux server for power little endian update services for sap solutions/8.6
• canonical/redhat enterprise linux server tus
• version/redhat enterprise linux server tus/8.6
• canonical/redhat enterprise linux server update services for sap solutions
• version/redhat enterprise linux server update services for sap solutions/8.6
• canonical/redhat virtualization host
• version/redhat virtualization host/4.0
• canonical/redhat codeready linux builder
• version/redhat enterprise linux/8.6
• vendor/netapp
• canonical/netapp h300s firmware
• canonical/netapp h300s
• canonical/netapp h500s firmware
• canonical/netapp h500s
• canonical/netapp h700s firmware
• canonical/netapp h700s
• canonical/netapp h300e firmware
• canonical/netapp h300e
• canonical/netapp h500e firmware
• canonical/netapp h500e
• canonical/netapp h700e firmware
• canonical/netapp h700e
• canonical/netapp h410s firmware
• canonical/netapp h410s
• canonical/netapp h410c firmware
• canonical/netapp h410c
• vendor/debian
• canonical/debian debian linux
• version/debian debian linux/9.0
• version/debian debian linux/10.0
• vendor/oracle
• canonical/oracle communications cloud native core binding support function
• version/oracle communications cloud native core binding support function/22.1.3
• package-manager/debian