In static initializers of io_uring.c, there is an insecure default value. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "1663475816271614556256250790833541410", "182074779714685663080300744911220610136", "268283764276646451999148176421313602582", "229081147662135917765128039681371887510" ] }, "id": "ASB-A-264692298-46d19be6", "source": "https://android.googlesource.com/kernel/common/+/75454b4bbfc7e", "deprecated": false, "signature_version": "v1", "target": { "file": "fs/io_uring.c" }, "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "1663475816271614556256250790833541410", "182074779714685663080300744911220610136", "268283764276646451999148176421313602582", "229081147662135917765128039681371887510" ] }, "id": "ASB-A-264692298-bb6cfd65", "source": "https://android.googlesource.com/kernel/common/+/03c04a7cba972", "deprecated": false, "signature_version": "v1", "target": { "file": "fs/io_uring.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/03c04a7cba972", "https://android.googlesource.com/kernel/common/+/75454b4bbfc7e" ], "spl": "2023-04-05", "severity": "High", "types": [ "EoP" ] }