Published: 22/04/2022 Updated: 08/08/2023

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

In the Linux kernel prior to 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
debian debian linux 11.0

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2021-4197 Eric Biederman reported that incorrect permission checks in the cgroup process migration implementation can allow a local attacker to escalate privileges CVE-2022-0168 A NU ...

An issue was discovered in fs/io_uringc in the Linux kernel through 5118 It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25 (CVE-2021-28951) A flaw was found in unrestricted eBPF usage by the ...

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF This flaw allows a local user to crash or escalate their privileges on the system (CVE-2022-0500) A flaw was found in the Linux kernel in linux/net/netfilter/nf_table ...

A denial of service (DOS) issue was found in the Linux kernel&rsquo;s smb2_ioctl_query_info function in the fs/cifs/smb2opsc Common Internet File System (CIFS) due to an incorrect return from the memdup_user function This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system (CVE-2022-0168) When the KVM updates the gue ...

In the Linux kernel before 5173, fs/io_uringc has a use-after-free due to a race condition in io_uring timeouts This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently ...

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF This flaw allows a local user to crash or escalate their privileges on the system (CVE-2022-0500) A flaw was found in the Linux kernel in linux/net/netfilter/nf_table ...

A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user triggers a race condition between timeout flush and removal This flaw allows a local user to crash or escalate their privileges on the system (CVE-2022-29582) ...

Exploit for CVE-2022-29582 targeting Google's Kernel CTF

CVE-2022-29582 This repository contains exploit code for CVE-2022-29582, a Local Privilege Escalation in io_uring (of the Linux kernel) Default configurations are affected and no special privileges should be needed You can find the writeup at ruia-ruiagithubio/2022/08/05/CVE-2022-29582-io-uring/ Building Running make should res

CWE-362 https://www.openwall.com/lists/oss-security/2022/04/22/3 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e677edbcabee849bfdd43f1602bccbecf736a646 https://github.com/torvalds/linux/commit/e677edbcabee849bfdd43f1602bccbecf736a646 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.3 http://www.openwall.com/lists/oss-security/2022/04/22/4 https://www.debian.org/security/2022/dsa-5127 http://www.openwall.com/lists/oss-security/2022/08/08/3 https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/https://github.com/Ruia-ruia/CVE-2022-29582-Exploit https://nvd.nist.gov https://www.debian.org/security/2022/dsa-5127 https://github.com/Ruia-ruia/CVE-2022-29582-Exploit

CVE-2022-29582

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect