Описание
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
Отчет
A low-impact flaw was found in the Linux kernel's io_uring subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and the kernel package in Red Hat Enterprise Linux 10. In the io_link_skb() function, the pointer to the previous notification is incorrectly derived from the current notification descriptor ('nd' instead of 'prev_nd'), so the context validation compares the current notification with itself rather than with the previous notification. This can render ineffective the check that stacked notifications belong to the same io_uring context and can be completed in the same task_work, leading to potential mis-association of notification objects. A local user able to use io_uring can reach this code path without special privileges; however, the upstream fix describes a correctness bug with no demonstrated use-after-free or out-of-bounds access, so the realistic security impact is limited. Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1, are not affected because the vulnerable code is not present in those products. For the affected Red Hat Enterprise Linux 9 and 10 streams, the fix is deferred because of the low security impact; the residual risk is limited to weakened validation of io_uring notification context ownership, which could only matter in combination with other io_uring lifetime bugs. The difference from the NIST/CVE.org CVSS score of 7.8 (Important) reflects that Red Hat found no evidence of confidentiality or integrity impact and scored the flaw accordingly (CVSS 5.5, availability impact only).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
Уязвимость функции io_link_skb() модуля io_uring/notif.c интерфейса асинхронного ввода/вывода ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
5.5 Medium
CVSS3