In the Linux kernel before 5.4.2, the iouring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/iouring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORINGOPSENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.
[
{
"id": "CVE-2019-19241-06f48857",
"signature_version": "v1",
"digest": {
"function_hash": "239696763540033943399909030527528752838",
"length": 554.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io-wq.c",
"function": "__io_worker_unuse"
}
},
{
"id": "CVE-2019-19241-091777ce",
"signature_version": "v1",
"digest": {
"function_hash": "40156399538452738778757929689976725986",
"length": 150.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d69e07793f891524c6bbf1e75b9ae69db4450953",
"signature_type": "Function",
"target": {
"file": "net/socket.c",
"function": "__sys_sendmsg_sock"
}
},
{
"id": "CVE-2019-19241-1b7e4852",
"signature_version": "v1",
"digest": {
"function_hash": "198815207433786643051198735085346131018",
"length": 2403.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io_uring.c",
"function": "io_uring_create"
}
},
{
"id": "CVE-2019-19241-23f691b2",
"signature_version": "v1",
"digest": {
"function_hash": "43374760334701555609734892475253280282",
"length": 1828.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io-wq.c",
"function": "io_wq_create"
}
},
{
"id": "CVE-2019-19241-2cd20af8",
"signature_version": "v1",
"digest": {
"function_hash": "210078859062895078713071843515245931270",
"length": 679.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io_uring.c",
"function": "io_ring_ctx_free"
}
},
{
"id": "CVE-2019-19241-5ed30f93",
"signature_version": "v1",
"digest": {
"function_hash": "227344090751576426261276735681348682782",
"length": 1462.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io_uring.c",
"function": "io_sq_offload_start"
}
},
{
"id": "CVE-2019-19241-937bfcc8",
"signature_version": "v1",
"digest": {
"function_hash": "299472398673548293531162417166508166289",
"length": 143.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d69e07793f891524c6bbf1e75b9ae69db4450953",
"signature_type": "Function",
"target": {
"file": "net/socket.c",
"function": "__sys_recvmsg_sock"
}
},
{
"id": "CVE-2019-19241-9b6ab99e",
"signature_version": "v1",
"digest": {
"function_hash": "194154812795169334277775392725902748957",
"length": 1642.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Function",
"target": {
"file": "fs/io_uring.c",
"function": "io_sq_thread"
}
},
{
"id": "CVE-2019-19241-b322da39",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"116333758401622267722450321662351657602",
"97122048399322879828239969418289461381",
"292991730147472984483661457453360816543",
"324627060952875697807996536948167103247",
"40388449120082130065460015186847396006",
"134545061499449008107430873811732383988",
"207039164889648986592233494615447581981",
"58806393471852734388731300659392974122",
"5801595800044889153155418497430020084",
"187726890280507592801792840053205208212",
"196848263135197460974029355953473052461",
"236113220903675422737560300867283867801",
"51958985185981519126617912519091065230",
"73623656193248295937117775559357559587",
"63625945202720374717360493868797883798",
"18803942167231763160772819156683386632"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d69e07793f891524c6bbf1e75b9ae69db4450953",
"signature_type": "Line",
"target": {
"file": "net/socket.c"
}
},
{
"id": "CVE-2019-19241-c4367f95",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"156281723857614143693651030682623261303",
"187063138910770631317283318172176852242",
"303867641155907623329279845849321381136",
"23627754986720252363223167358997182507",
"161222997641083240981998373493844454996",
"272404477710112077902591727730022028041",
"334791324653031551180696160972211631555",
"198445662658042097362593874082589891765",
"266420579120171841508685331000172645147",
"108383926456892883213443721920471863876",
"133103843923786898682487739402751197743",
"113843092363178804022930569847500539720",
"134009815069166024452989710585572737804",
"223625894554947449828861764271899323383",
"276756483308263751005792781829772574182",
"183554471080354830016078971009405413050",
"180348610826769566239051455795481862285",
"192382280213132237920631395207985569878",
"153734781065930691648741454768728591299",
"42646072082844582263270326946168190152",
"233721698946197439687378699939736470602",
"196131583202449487650066367655502563718",
"32910671364146759704315481244182035591",
"87968195293905837656452932451125516348",
"193064642187997264144728925019193270554",
"252815964391907293481735136174618366572",
"184783431550469819175893934061367204757"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Line",
"target": {
"file": "fs/io_uring.c"
}
},
{
"id": "CVE-2019-19241-e75ad40a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47818813700349336656888639893912777033",
"214688733531604672949326554743758292912",
"55781516579607552174044677811912452017",
"254299216446969116902323051385629715599",
"221384323325256245897967487410412873675",
"280122384840255287207249480475577687792",
"257659005469624945682487847072554182517",
"284376373026302623832178158781417657140",
"141485444903559995432960203762165425028",
"98598616195566709579169413180577151788",
"304696810816133444988947312007123541641",
"185387260428081095248851857832532826698",
"276681813584017217118321737902063836914",
"59769126275736127062882434905225532737",
"335341398004667765213915291340015187199",
"245181122394851199578011974602254798426",
"9059318474107268507784875588724306369",
"137646804920944976300131797119576088499",
"114428990196553315926183495383890151645"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Line",
"target": {
"file": "fs/io-wq.c"
}
},
{
"id": "CVE-2019-19241-ff3cd45a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"134095682588549071694586428184894592614",
"241394426153656854481212742793358287653",
"222241917552705699173126635758125415282",
"117399463774851903719539257382475353489"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@181e448d8709e517c9c7b523fcd209f24eb38ca7",
"signature_type": "Line",
"target": {
"file": "fs/io-wq.h"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19241.json"