There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation.
In the ioprepasyncwork function the assumption that the last iograbidentity call cannot return false is not true, and in this case the function will use the initcred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0240.json"
[
{
"id": "CVE-2023-0240-41ac018a",
"target": {
"function": "io_prep_async_work",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "141482328393426952042825944976519786036",
"length": 2191.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-4c9137d7",
"target": {
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292939682534603269169064303829766360445",
"252606664228205050713574693690165232788",
"52536464942013722913872778363819686538",
"240535538000105004795907414858003394569",
"204740592105327955159025709677057796008",
"215067559559023795600587300765551554023",
"60816826883158602802731777605747619068",
"24791799785143379582932455507765026877",
"287255869818097464982772723968501423914",
"255196108100693378328933282886209207783",
"76071869369504566328469477672128768933",
"40251502362782463780711242235779059989",
"76463262502077329601491461416759339161",
"58316251803180542988660777290075266988",
"215209444362986658203794555663407641259",
"189043074674498314294893051583258240921",
"248179494456006537452357706479494015556",
"38306770885061036097843671039793658208",
"337508624568357336446603351629763150912",
"321673981255759260649645865600438843933",
"225315113183805493667831239090244131836",
"34183107661734254548776879281739284745",
"233062597584641196531283030134427808051",
"313566492084392616375027880166757924966",
"190818874733898010033653665300599437505",
"338033306765304580927295356565259166957",
"10695392828460101937880804808886440483",
"70301753764221596196068231924070479759",
"41923656186339840879269125182368756738",
"43565609990840379807821601881058921042",
"332154219032500940151515760036096379429",
"42464550287182552948815287139921739610",
"67460962584367626867548979542003961934",
"32180464923644643317669053188668413914",
"128004248227447383064936362971276535097",
"233217880997268038978527800087414240286",
"67127713171252168915615991912692307584",
"152915851895305575874195468676820934156",
"262214651266321872609865018879376096890",
"324366145051484269809986665382738555878",
"51734362249438105171119795149780123451",
"39797194110280857395026455156903809423",
"184368938194472542745374261863445429854",
"97071448727430965565944853952345836590",
"64430440649341808700258217290243833387",
"312599560111996565872741244137541516474",
"183100936007005165589901900065826839360",
"290802307806517262537856179267399683924",
"306339086891381134879688435928983728349",
"80605825127737181465821190009977869120",
"184097718405628244634147033214862419099",
"227689746282964300759853214849409252378",
"146006907643500811420995677964474236586",
"183118020609005389904314705927651468480",
"63846188013860378018449664901367112888",
"264272207517446819807529349050510046211",
"81293970311489679111381109596073577319",
"25431398923014600283952189061555697888",
"256777055221798139417373773452713922001",
"292096071294169929099251425475208373650",
"82521597151540060886047978901785063534",
"318514627244092653213623480932836925783",
"231504183984706876101225856844544740466",
"36298528724293836086664793604050774753",
"302614212776719905753380271435296986452",
"241646204125075971865508394801193460008",
"333290383664115364674504813790433099100",
"263529517695460650781920197358306170503",
"173754123692304714522010553814617970899",
"310661399308049290727400001355863727787",
"276652710332910392004364274115373935798",
"192772338695074250035987642869796590898",
"336903277003964555374845295962426595001",
"310374389788596023395063704672620657153",
"250560227055520528529267781345048110840",
"273604414908769588300345241204802403577",
"204598204177048523387551140841938921279",
"70036682268302511216972597495868547945",
"321425530848313733198767891555580892452",
"84113838449842201507223776575837497341",
"155194082467183384785248009222566742817",
"277958428916735920427286828729723753527",
"154552043850169219343885626395413902559",
"49180201608772176304900517378136541724",
"335471400360034863209285177865858850564",
"99859719508918970288502936977736256110",
"112463902516482365919652190920283219957",
"198836633771267964998254834531428738154",
"146478684753923779287449035878626741216",
"36860598166070838684784305614130582953",
"165454623943145597835328142923435940371",
"174727933343417979091184763550062786594",
"149914782293960819851835022027944244765",
"15898706484727841201304744178886724855",
"215320372819643627041005951209297535152",
"293941758167041284895837096490446504418",
"166086210939393515084014702568116564887",
"196938129322088485531822265601687363298",
"232736586000629713206306326648941889196",
"62977917794067525779391648552069494247",
"88799373405316028779673883954130698478",
"276451607902962215720646769313996591275",
"46005004727601446089631779265721856883",
"162835851107008250291939302763339488603",
"13003215277462399570143552118834751052",
"182373847789877511289588206003699434632",
"326449932614163059886337544431148796164",
"11288288309974783491107736808984244909",
"173656760459307235522110727303702619990",
"90329070355526520347910572605792560405",
"246259800238095630175706452804246499491",
"224626103121715555126356526735589592075",
"301732271107252386617051601215897016230"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-0240-5c7bd33c",
"target": {
"function": "io_init_req",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "143988850729750513190559750841478103056",
"length": 1354.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-5f10facc",
"target": {
"function": "io_req_clean_work",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "211853336452043182435696335853752918015",
"length": 935.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-61e16539",
"target": {
"function": "io_remove_personalities",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "164647556893189730673595739245367085799",
"length": 210.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-700eab8f",
"target": {
"file": "include/linux/io_uring.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108978303168412986017161472296871153378",
"62988986319239578025184116413979854436",
"175936630833479445854956217208713668047",
"112988179336494384166446806433813930110"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-0240-73eced06",
"target": {
"function": "io_req_init_async",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "82925637373950419682689230215305989311",
"length": 260.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-9fca7439",
"target": {
"function": "__io_free_req",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "335866989049259154307553811474517214741",
"length": 435.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-afe0c0a4",
"target": {
"function": "io_unregister_personality",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "56562345869322821046192806116928118486",
"length": 205.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-0240-c66ff57b",
"target": {
"function": "io_register_personality",
"file": "fs/io_uring.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
"digest": {
"function_hash": "309567847345704633829571923532657335418",
"length": 232.0
},
"signature_type": "Function"
}
]