REDHAT-BUG-2254050: High severity The Linux Foundation Linux Kernel vulnerability

Published Dec 11, 2023

Updated

Since commit c56e022c0a27 ("iouring: add support for user mapped provided buffer ring"), landed in Linux 6.4, iouring makes it possible to allocate, mmap, and deallocate "buffer rings".

A "buffer ring" can be allocated with iouringregister(..., IORINGREGISTERPBUFRING, ...) and later deallocated with iouringregister(..., IORINGUNREGISTERPBUFRING, ...). It can be mapped into userspace using mmap() with offset IORINGOFFPBUFRING|..., which creates a VMPFNMAP mapping, meaning the MM subsystem will treat the mapping as a set of opaque page frame numbers not associated with any corresponding pages; this implies that the calling code is responsible for ensuring that the mapped memory can not be freed before the userspace mapping is removed.

However, there is no mechanism to ensure this in iouring: It is possible to just register a buffer ring with IORINGREGISTERPBUFRING, mmap() it, and then free the buffer ring's pages with IORINGUNREGISTERPBUFRING, leaving free pages mapped into userspace, which is a fairly easily exploitable situation.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c392cbecd8eca4c53f2bf508731257d9d0a21c2d

Affected Software

1 affected component

The Linux Foundation Linux Kernel>=6.4

Event History

Dec 11, 2023

Data Sourced

via Red Hat·05:51 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running a Linux kernel with io_uring support for user-mapped provided buffer rings are exposed. That support was introduced in Linux 6.4.

What does an attacker need to exploit it?

An attacker needs the ability to invoke io_uring registration and mmap operations locally. They can register a provided buffer ring, map it into userspace, and unregister it while the mapping remains.

Is this condition likely exploitable?

Yes. Unregistering the buffer ring can free pages that remain mapped in userspace, creating a use-after-free condition described as fairly easily exploitable.

How can I determine whether the vulnerable condition is present?

Check whether the running kernel includes user-mapped provided buffer ring support and permits the sequence of IORING_REGISTER_PBUF_RING, mmap() with IORING_OFF_PBUF_RING, and IORING_UNREGISTER_PBUF_RING. The vulnerable behavior is present if unregistering succeeds while the userspace mapping remains active.

REDHAT-BUG-2254050: High severity The Linux Foundation Linux Kernel vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Is this condition likely exploitable?

How can I determine whether the vulnerable condition is present?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Is this condition likely exploitable?

How can I determine whether the vulnerable condition is present?