CVE-2023-0469: Integer Underflow
A use-after-free flaw was found in iouring/filetable.c in ioinstallfixedfile in the iouring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.
Other sources
There is an interesting reference bug when -ENOMEM occurs in calling of ioinstallfixedfile(). KASan report like below:
[ 14.057131] ================================================================== [ 14.059161] BUG: KASAN: use-after-free in unixgetsocket+0x10/0x90 [ 14.060975] Read of size 8 at addr ffff88800b09cf20 by task kworker/u8:2/45 [ 14.062684] [ 14.062768] CPU: 2 PID: 45 Comm: kworker/u8:2 Not tainted 6.1.0-rc4 #1 [ 14.063099] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 14.063666] Workqueue: eventsunbound ioringexitwork [ 14.063936] Call Trace: [ 14.064065] <TASK> [ 14.064175] dumpstacklvl+0x34/0x48 [ 14.064360] printreport+0x172/0x475 [ 14.064547] ? rawspinlockirq+0x83/0xe0 [ 14.064758] ? virtaddrvalid+0xef/0x170 [ 14.064975] ? unixgetsocket+0x10/0x90 [ 14.065167] kasanreport+0xad/0x130 [ 14.065353] ? unixgetsocket+0x10/0x90 [ 14.065553] unixgetsocket+0x10/0x90 [ 14.065744] iosqefilesunregister+0x87/0x1e0 [ 14.065989] ? iorsrcrefsdrop+0x1c/0xd0 [ 14.066199] ioringexitwork+0x388/0x6a5 [ 14.066410] ? iouringtrycancelrequests+0x5bf/0x5bf [ 14.066674] ? trytowakeup+0xdb/0x910 [ 14.066873] ? virttoheadpage+0xbe/0xbe [ 14.067080] ? schedule+0x574/0xd20 [ 14.067273] ? readwordatatime+0xe/0x20 [ 14.067492] ? strscpy+0xb5/0x190 [ 14.067665] processonework+0x423/0x710 [ 14.067879] workerthread+0x2a2/0x6f0 [ 14.068073] ? processonework+0x710/0x710 [ 14.068284] kthread+0x163/0x1a0 [ 14.068454] ? kthreadcompleteandexit+0x20/0x20 [ 14.068697] retfromfork+0x22/0x30
Reference: https://github.com/torvalds/linux/commit/9d94c04c0db024922e886c9fd429659f22f48ea4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0469?
CVE-2023-0469 is classified as a moderate severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2023-0469?
To fix CVE-2023-0469, update to kernel versions 6.1 or higher, or the specified remedial versions from your distribution.
What causes CVE-2023-0469?
CVE-2023-0469 is caused by a use-after-free flaw in the io_uring component of the Linux Kernel.
What systems are affected by CVE-2023-0469?
CVE-2023-0469 affects Linux Kernel versions up to and including 6.1.
Can CVE-2023-0469 lead to additional attacks?
While CVE-2023-0469 primarily causes a denial of service, its exploitation can potentially open avenues for further system vulnerabilities.