CVE-2022-2959: Linux Kernel Watch Queue Race Condition Privilege Escalation Vulnerability

A race condition was found in the Linux kernel's watch queue due to a missing lock in piperesizering(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.

A race condition was found in the Linux kernel's watch queue due to a missing lock in the piperesizering(). The race condition occurs when a thread uses ioctl(IOCWATCHQUEUESETSIZE) to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl() to trigger a notification in the watch queue, calling postonenotification() and accessing the freed pipe buffer. This flaw allows a local user to crash the system or escalate their privileges on the system.

In piperesizeresults of pipe.c, there is a possible UAF bug caused by a race condition. This could lead to local denial of service and local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

— ZDI