CVE-2024-0582: Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap
A memory leak flaw was found in the Linux kernel’s iouring functionality in how a user registers a buffer ring with IORINGREGISTERPBUFRING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
Since commit c56e022c0a27 ("iouring: add support for user mapped provided buffer ring"), landed in Linux 6.4, iouring makes it possible to allocate, mmap, and deallocate "buffer rings".
A "buffer ring" can be allocated with iouringregister(..., IORINGREGISTERPBUFRING, ...) and later deallocated with iouringregister(..., IORINGUNREGISTERPBUFRING, ...). It can be mapped into userspace using mmap() with offset IORINGOFFPBUFRING|..., which creates a VMPFNMAP mapping, meaning the MM subsystem will treat the mapping as a set of opaque page frame numbers not associated with any corresponding pages; this implies that the calling code is responsible for ensuring that the mapped memory can not be freed before the userspace mapping is removed.
However, there is no mechanism to ensure this in iouring: It is possible to just register a buffer ring with IORINGREGISTERPBUFRING, mmap() it, and then free the buffer ring's pages with IORINGUNREGISTERPBUFRING, leaving free pages mapped into userspace, which is a fairly easily exploitable situation.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c392cbecd8eca4c53f2bf508731257d9d0a21c2d
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.6.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0582?
CVE-2024-0582 has been classified as a high severity vulnerability due to its potential to allow local users to crash or escalate privileges.
How do I fix CVE-2024-0582?
To fix CVE-2024-0582, update your Linux kernel to version 5.10.226-1 or later, or 6.1.128-1 or later, or apply any vendor-provided patch.
Which Linux kernel versions are affected by CVE-2024-0582?
CVE-2024-0582 affects Linux kernel versions prior to 6.4 and specific release candidates including 6.7-rc1, 6.7-rc2, and 6.7-rc3.
Can CVE-2024-0582 be exploited remotely?
No, CVE-2024-0582 can only be exploited by local users on the affected system.
What is io_uring in the context of CVE-2024-0582?
In the context of CVE-2024-0582, io_uring is a Linux kernel feature that allows asynchronous I/O, and the vulnerability arises during the registration of buffer rings.