Description
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.
Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability.
We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux Kernel | 5.19 – < 6.1 | 6.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.12-1 | — |
| Debian 13 | linux | 6.0.12-1 | — |
| Debian 12 | linux | 6.0.12-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux-hwe-5.19 | 5.19.0-38.39~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-5.19 | 5.19.0-1021.22~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-oem-6.0 | 6.0.0-1012.12 | — |
| Ubuntu 22.04 LTS | linux-riscv +1 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv +23 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Advisories 1
- WID-SEC-2023-1118 Linux Kernel: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Mar 20, 2024