UBUNTU-CVE-2021-41073
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
02 / AFFECTED SOFTWARE
Affected packages
23 explicit affected versions
6 explicit affected versions
10 explicit affected versions
44 explicit affected versions
16 explicit affected versions
4 explicit affected versions
38 explicit affected versions
13 explicit affected versions
12 explicit affected versions
33 explicit affected versions
43 explicit affected versions
10 explicit affected versions
50 explicit affected versions
7 explicit affected versions
9 explicit affected versions
4 explicit affected versions
4 explicit affected versions
4 explicit affected versions
4 explicit affected versions
4 explicit affected versions
5 explicit affected versions
7 explicit affected versions
19 explicit affected versions
3 explicit affected versions
29 explicit affected versions
4 explicit affected versions
5 explicit affected versions
6 explicit affected versions
12 explicit affected versions
3 explicit affected versions
10 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
05 / REFERENCES
Further evidence
- http://www.openwall.com/lists/oss-security/2021/09/18/2
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc
- https://ubuntu.com/security/CVE-2021-41073
- https://ubuntu.com/security/notices/USN-5092-1
- https://ubuntu.com/security/notices/USN-5092-2
- https://ubuntu.com/security/notices/USN-5096-1
- https://ubuntu.com/security/notices/USN-5106-1
- https://www.cve.org/CVERecord?id=CVE-2021-41073