Executive Summary

This vulnerability exists in the Linux kernel's io_uring subsystem, specifically in the io_zcrx_put_niov_uref() function. The function uses a non-atomic check-then-decrement pattern to manipulate user reference counters, which is supposed to be serialized by a lock (rq_lock). However, another function, io_zcrx_scrub(), modifies the same counter without holding this lock, leading to a race condition on SMP (multi-processor) systems.

Due to this race, the same memory object (niov) can be freed twice (double-free), causing the freelist's free_count to exceed its limit. This results in out-of-bounds writes past the allocated freelist array into adjacent memory, potentially corrupting memory.

The fix involved replacing the non-atomic decrement with an atomic compare-and-exchange loop to safely decrement the user reference counter, preventing the race without requiring the scrub function to acquire the lock.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption due to out-of-bounds writes caused by a double-free condition in the kernel's io_uring subsystem. Memory corruption can potentially be exploited to cause system crashes, data corruption, or privilege escalation, depending on how an attacker leverages the flaw.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in the Linux kernel by changing the io_zcrx_put_niov_uref() function to use an atomic_try_cmpxchg loop that safely decrements user_refs, preventing the race condition.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0