Executive Summary

This vulnerability is an out-of-bounds (OOB) read issue in the Linux kernel's io_uring subsystem, specifically in the fdinfo functionality. The problem occurs in the function __io_uring_show_fdinfo(), which iterates over pending submission queue entries (SQEs). For 128-byte SQEs on an IORING_SETUP_SQE_MIXED ring, the code attempts to detect when the second half of the SQE would exceed the bounds of the sq_sqes array. However, the existing check incorrectly uses an incremented sq_head value that does not account for every iteration, leading to a situation where the array index can point past the last valid slot, causing an out-of-bounds read.

The fix involves checking the actual array index (sq_idx) directly instead of relying on the sq_head increment condition. This ensures that the iteration does not read beyond the valid array boundary while maintaining the logic to skip the second half of the 128-byte SQE on the next iteration.

Useful 0 Not Useful 0

Impact Analysis

An out-of-bounds read vulnerability like this can potentially lead to information disclosure, where sensitive kernel memory might be read unintentionally. This could allow an attacker with access to the io_uring interface to gain unauthorized information about kernel memory contents.

While the description does not specify exploitation details such as privilege escalation or denial of service, out-of-bounds reads generally pose a risk of leaking sensitive data or causing system instability.

Useful 0 Not Useful 0