CVE-2023-0240 — Use After Free in Linux Kernel

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.14.6-1 (bookworm)	linux 5.14.6-1 (bookworm)
linux	linux_kernel	< 5.10	5.10
linux	linux_kernel	>= 0 < 5.10.162-1	5.10.162-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	5.10 – 5.10.161	—

GHSA

GHSA-rr76-fj9v-7w82: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation

ghsa_unreviewed·2023-01-30

CVE-2023-0240 [HIGH] CWE-416 GHSA-rr76-fj9v-7w82: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

OSV

CVE-2023-0240: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation

osv·2023-01-30·CVSS 7.8

CVE-2023-0240 [HIGH] CVE-2023-0240: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

Debian

CVE-2023-0240: linux - There is a logic error in io_uring's implementation which can be used to trigger...

vendor_debian·2023·CVSS 7.8

CVE-2023-0240 [HIGH] CVE-2023-0240: linux - There is a logic error in io_uring's implementation which can be used to trigger... There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

Red Hat

kernel: io_uring: reference counting issue in io_prep_async_work leads to use-after-free

vendor_redhat·2020-10-17·CVSS 7.8

CVE-2023-0240 [HIGH] CWE-416 kernel: io_uring: reference counting issue in io_prep_async_work leads to use-after-free kernel: io_uring: reference counting issue in io_prep_async_work leads to use-after-free There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161. A logic error was found in the io_uring subsystem of the Linux kernel. This issue occurs due to an incorrect assumption that the last io_grab_identity call could not return false in

CVE-2023-0240: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the…

Affected

CVSS provenance