CVE-2022-4696
published 2023-01-11CVE-2022-4696: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.41%
32.9th percentile
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 5.10 < 5.12 | 5.12 |
| linux | linux_kernel | 5.7-rc1 – 5.10.159 | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_kernel_5.10.181.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-4696: In static initializers of io_uring
osv·2023-04-01
CVE-2022-4696 CVE-2022-4696: In static initializers of io_uring
In static initializers of io_uring.c, there is an insecure default value. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2022-4696: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation
osv·2023-01-11·CVSS 7.8
CVE-2022-4696 [HIGH] CVE-2022-4696: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
GHSA
GHSA-8vjx-3vgx-66mx: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation
ghsa_unreviewed·2023-01-11
CVE-2022-4696 [HIGH] CWE-416 GHSA-8vjx-3vgx-66mx: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Android
CVE-2022-4696: io_uring
vendor_android·2023-04-01·CVSS 7.8
CVE-2022-4696 [HIGH] CVE-2022-4696: io_uring
Android Security Bulletin 2023-04-01
CVE: CVE-2022-4696
Severity: HIGH
Type: EoP
Component: io_uring
References: A-264692298
Upstream kernel
[2]
Microsoft
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag which signals that the ope
vendor_msrc·2023-01-10·CVSS 7.8
CVE-2022-4696 [HIGH] CWE-416 There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag which signals that the ope
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag which signals that the operation won't use current->nsproxy so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro i
Red Hat
kernel: user-after-free during IORING_OP_SPLICE operation
vendor_redhat·2022-12-19·CVSS 7.8
CVE-2022-4696 [HIGH] CWE-911 kernel: user-after-free during IORING_OP_SPLICE operation
kernel: user-after-free during IORING_OP_SPLICE operation
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
A use-after-free flaw was found in the io_uring subsystem of the Linux kernel. This issue occurs during the IORING_OP_SPLICE operation due to a missing IO_WQ_WORK_FILES f
Debian
CVE-2022-4696: linux - There exists a use-after-free vulnerability in the Linux kernel through io_uring...
vendor_debian·2022·CVSS 7.8
CVE-2022-4696 [HIGH] CVE-2022-4696: linux - There exists a use-after-free vulnerability in the Linux kernel through io_uring...
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Scope: local
bookworm: resolved (fixed in 5.14.6-1)
bullseye: resolved (fixed in 5.10.162-1)
forky: resolved (fixed in 5.14.6-1)
sid: resolved (fixed in 5.14.6-1)
trixie: resolved (fixed in 5.14.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61ahttps://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61ahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61ahttps://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61ahttps://security.netapp.com/advisory/ntap-20230223-0003/
2023-01-11
Published