Описание
In the Linux kernel, the following vulnerability has been resolved:
io_uring/zctx: check chained notif contexts
Send zc only links ubuf_info for requests coming from the same context.
There are some ambiguous syz reports, so let's check the assumption on
notification completion.
A flaw was found in the Linux kernel. A local attacker could exploit an improper handling of chained notification contexts within the io_uring/zctx component. This could lead to a denial of service (DoS) on the system.
Отчет
A low impact denial-of-service flaw was found in the Linux kernel's io_uring zero-copy send notification handling (io_uring/notif.c). The send zero-copy code links ubuf_info notification structures only for requests originating from the same zero-copy context, but that assumption was not validated when chained notifications completed. A local attacker able to submit io_uring requests could exploit this improper handling of chained notification contexts to cause a denial of service. This flaw affects the kernels shipped in Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10 (kernel); Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1.1 are not affected because the vulnerable code is not present in those kernels. Because this flaw is rated Low severity, the fix for the affected Red Hat Enterprise Linux 9 and 10 streams is deferred to a future scheduled kernel update; the residual risk is a local user causing a denial of service, and only on systems where io_uring has been explicitly enabled by an administrator, since in the default Red Hat Enterprise Linux kernel io_uring is disabled and cannot be used unless enabled through the kernel.io_uring_disabled sysctl parameter. Red Hat assesses the severity of this flaw as Low (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record severity of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the available technical evidence supports an availability-only impact, with no demonstrated confidentiality or integrity impact.
Меры по смягчению последствий
This flaw can only be triggered through the io_uring interface, which is disabled by default in Red Hat Enterprise Linux 9 and 10 (kernel.io_uring_disabled=2); no action is needed on systems where io_uring has not been explicitly enabled. On systems where an administrator has enabled io_uring, exploitation can be prevented by disabling it again: set the kernel.io_uring_disabled sysctl to 2, for example by running sysctl -w kernel.io_uring_disabled=2, and make the setting persistent via /etc/sysctl.conf or a file under /etc/sysctl.d/. With this setting, io_uring_setup() fails with -EPERM for all processes; note that applications relying on io_uring are affected, and io_uring instances that already exist at the time of the change can still be used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.
In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.
In the Linux kernel, the following vulnerability has been resolved: i ...
In the Linux kernel, the following vulnerability has been resolved: io_uring/zctx: check chained notif contexts Send zc only links ubuf_info for requests coming from the same context. There are some ambiguous syz reports, so let's check the assumption on notification completion.
EPSS
5.5 Medium
CVSS3