CVE-2022-3176

2022-09-1600:00:00

ubuntu.com

linux kernel

use-after-free

io_uring

vulnerability

waitqueue

signalfd_poll

binder_poll

upgrade

commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

14.3%

JSON

There exists a use-after-free in io_uring in the Linux kernel.
Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the
current task. It will send a POLLFREE notification to all waiters before
the queue is freed. Unfortunately, the io_uring poll doesn’t handle
POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd
is polled with io_uring poll, and the waitqueue gets freed. We recommend
upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-128.144UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-50.56UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1086.93UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1021.25UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1021.25~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1086.93~18.04.1UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1094.100UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1021.26UNKNOWN
ubuntu20.04noarchlinux-azure-5.15< 5.15.0-1021.26~20.04.1UNKNOWN
ubuntu18.04noarchlinux-azure-5.4< 5.4.0-1094.100~18.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-128.144	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-50.56	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1086.93	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1021.25	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1021.25~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1086.93~18.04.1	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1094.100	UNKNOWN
ubuntu	22.04	noarch	linux-azure	< 5.15.0-1021.26	UNKNOWN
ubuntu	20.04	noarch	linux-azure-5.15	< 5.15.0-1021.26~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-azure-5.4	< 5.4.0-1094.100~18.04.1	UNKNOWN