race condition in io_uring lead to Local Privilege Escalation

[neoni]

Hello. I'm neoni. I would like to report a vulnerability that lead to Use After Free.

An unprivileged attacker may use this vulnerability to root to achieve local privilege escalation.

Here is the detail:
When io_uring does io_sqe_buffers_unregister/io_sqe_files_unregister operation, it will unlock ctx->uring_lock in io_rsrc_ref_quiesce process and later release files/buffers. So an attacker could submit a file/buffer read/write related operation by racing io_rsrc_ref_quiesce process. When files/buffers are released and ctx starts to deal with new sqe, an Use-After-Free will be triggered.

The vulnerability was already patched as a bug in Linux mainstream 5.19 and 6.0(https://github.com/torvalds/linux/commit/d11d31fc5d8a96f707facee0babdcffaafa38de2)(https://github.com/torvalds/linux/commit/b0380bf6dad4601d92025841e2b7a135d566c6e3).

a PoC crashes kernel is attached. It affects most recent ubuntu kernel images as well as some hwe/oem kernel like hwe-5.17.

[Thadeu Lima de Souza Cascardo (cascardo)]

Thanks, neoni. We appreciate the report. Sorry it took this long to get a response.

Those fixes are already applied in our 5.15 kernels and we don't support 5.19 and 6.0 anymore. Since these have been fixed in 6.1 and later kernels and 5.4 do not carry those features, we consider this issue fixed in all the supported kernels we currently ship.

Thanks again.
Cascardo.