CVE-2023-0240

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0240
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0240.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0240
Downstream
DEBIAN (1)
OESA (2)
UBUNTU (1)
Published
2023-01-30T13:17:09Z
Modified
2026-10-21T08:48:29Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Use after free in io_uring in the Linux Kernel
Details

There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation.

In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.

Database specific 
{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0240.json"
}
References

Affected packages

Git / github.com/gregkh/linux

Affected ranges

Type
GIT
Repo
https://github.com/gregkh/linux
Events
Introduced
2c85ebc57b3e1817b6ce1a6b703928e113a90442
Fixed
1e6fa5216a0e59ef02e8b6b40d553238a3b81d49
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "5.10"
                },
                {
                    "last_affected":  "5.10.161"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "1e6fa5216a0e59ef02e8b6b40d553238a3b81d49"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0240.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "141482328393426952042825944976519786036",
            "length":  2191
        },
        "id":  "CVE-2023-0240-41ac018a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_prep_async_work"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292939682534603269169064303829766360445",
                "252606664228205050713574693690165232788",
                "52536464942013722913872778363819686538",
                "240535538000105004795907414858003394569",
                "204740592105327955159025709677057796008",
                "215067559559023795600587300765551554023",
                "60816826883158602802731777605747619068",
                "24791799785143379582932455507765026877",
                "287255869818097464982772723968501423914",
                "255196108100693378328933282886209207783",
                "76071869369504566328469477672128768933",
                "40251502362782463780711242235779059989",
                "76463262502077329601491461416759339161",
                "58316251803180542988660777290075266988",
                "215209444362986658203794555663407641259",
                "189043074674498314294893051583258240921",
                "248179494456006537452357706479494015556",
                "38306770885061036097843671039793658208",
                "337508624568357336446603351629763150912",
                "321673981255759260649645865600438843933",
                "225315113183805493667831239090244131836",
                "34183107661734254548776879281739284745",
                "233062597584641196531283030134427808051",
                "313566492084392616375027880166757924966",
                "190818874733898010033653665300599437505",
                "338033306765304580927295356565259166957",
                "10695392828460101937880804808886440483",
                "70301753764221596196068231924070479759",
                "41923656186339840879269125182368756738",
                "43565609990840379807821601881058921042",
                "332154219032500940151515760036096379429",
                "42464550287182552948815287139921739610",
                "67460962584367626867548979542003961934",
                "32180464923644643317669053188668413914",
                "128004248227447383064936362971276535097",
                "233217880997268038978527800087414240286",
                "67127713171252168915615991912692307584",
                "152915851895305575874195468676820934156",
                "262214651266321872609865018879376096890",
                "324366145051484269809986665382738555878",
                "51734362249438105171119795149780123451",
                "39797194110280857395026455156903809423",
                "184368938194472542745374261863445429854",
                "97071448727430965565944853952345836590",
                "64430440649341808700258217290243833387",
                "312599560111996565872741244137541516474",
                "183100936007005165589901900065826839360",
                "290802307806517262537856179267399683924",
                "306339086891381134879688435928983728349",
                "80605825127737181465821190009977869120",
                "184097718405628244634147033214862419099",
                "227689746282964300759853214849409252378",
                "146006907643500811420995677964474236586",
                "183118020609005389904314705927651468480",
                "63846188013860378018449664901367112888",
                "264272207517446819807529349050510046211",
                "81293970311489679111381109596073577319",
                "25431398923014600283952189061555697888",
                "256777055221798139417373773452713922001",
                "292096071294169929099251425475208373650",
                "82521597151540060886047978901785063534",
                "318514627244092653213623480932836925783",
                "231504183984706876101225856844544740466",
                "36298528724293836086664793604050774753",
                "302614212776719905753380271435296986452",
                "241646204125075971865508394801193460008",
                "333290383664115364674504813790433099100",
                "263529517695460650781920197358306170503",
                "173754123692304714522010553814617970899",
                "310661399308049290727400001355863727787",
                "276652710332910392004364274115373935798",
                "192772338695074250035987642869796590898",
                "336903277003964555374845295962426595001",
                "310374389788596023395063704672620657153",
                "250560227055520528529267781345048110840",
                "273604414908769588300345241204802403577",
                "204598204177048523387551140841938921279",
                "70036682268302511216972597495868547945",
                "321425530848313733198767891555580892452",
                "84113838449842201507223776575837497341",
                "155194082467183384785248009222566742817",
                "277958428916735920427286828729723753527",
                "154552043850169219343885626395413902559",
                "49180201608772176304900517378136541724",
                "335471400360034863209285177865858850564",
                "99859719508918970288502936977736256110",
                "112463902516482365919652190920283219957",
                "198836633771267964998254834531428738154",
                "146478684753923779287449035878626741216",
                "36860598166070838684784305614130582953",
                "165454623943145597835328142923435940371",
                "174727933343417979091184763550062786594",
                "149914782293960819851835022027944244765",
                "15898706484727841201304744178886724855",
                "215320372819643627041005951209297535152",
                "293941758167041284895837096490446504418",
                "166086210939393515084014702568116564887",
                "196938129322088485531822265601687363298",
                "232736586000629713206306326648941889196",
                "62977917794067525779391648552069494247",
                "88799373405316028779673883954130698478",
                "276451607902962215720646769313996591275",
                "46005004727601446089631779265721856883",
                "162835851107008250291939302763339488603",
                "13003215277462399570143552118834751052",
                "182373847789877511289588206003699434632",
                "326449932614163059886337544431148796164",
                "11288288309974783491107736808984244909",
                "173656760459307235522110727303702619990",
                "90329070355526520347910572605792560405",
                "246259800238095630175706452804246499491",
                "224626103121715555126356526735589592075",
                "301732271107252386617051601215897016230"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-0240-4c9137d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "143988850729750513190559750841478103056",
            "length":  1354
        },
        "id":  "CVE-2023-0240-5c7bd33c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_init_req"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211853336452043182435696335853752918015",
            "length":  935
        },
        "id":  "CVE-2023-0240-5f10facc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_req_clean_work"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "164647556893189730673595739245367085799",
            "length":  210
        },
        "id":  "CVE-2023-0240-61e16539",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_remove_personalities"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "108978303168412986017161472296871153378",
                "62988986319239578025184116413979854436",
                "175936630833479445854956217208713668047",
                "112988179336494384166446806433813930110"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2023-0240-700eab8f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "include/linux/io_uring.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "82925637373950419682689230215305989311",
            "length":  260
        },
        "id":  "CVE-2023-0240-73eced06",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_req_init_async"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "335866989049259154307553811474517214741",
            "length":  435
        },
        "id":  "CVE-2023-0240-9fca7439",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "__io_free_req"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "56562345869322821046192806116928118486",
            "length":  205
        },
        "id":  "CVE-2023-0240-afe0c0a4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_unregister_personality"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "309567847345704633829571923532657335418",
            "length":  232
        },
        "id":  "CVE-2023-0240-c66ff57b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49",
        "target":  {
            "file":  "fs/io_uring.c",
            "function":  "io_register_personality"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T08:48:29Z"