CVE-2024-0582

Published Jan 16, 2024

Last updated 7 months ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-0582 is a memory leak flaw found in the Linux kernel's io_uring functionality. Specifically, the vulnerability lies in how a user registers a buffer ring with `IORING_REGISTER_PBUF_RING`, maps it using `mmap()`, and then frees it. The kernel allocates memory for the provided buffer ring, but it doesn't check if the memory has been unmapped in userspace before freeing it. This use-after-free vulnerability in the io_uring subsystem can be triggered when an application registers a provided buffer ring with the `IOU_PBUF_RING_MMAP` flag. When the application unregisters the buffer ring using the `IORING_UNREGISTER_PBUF_RING` opcode, the kernel frees the memory without checking if it has been unmapped in userspace.

Description: A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secalert@redhat.com: CWE-416
nvd@nist.gov: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "83C3EF6F-6BC0-4B1C-A90A-0947025756C0",
            "versionEndExcluding": "6.6.5",
            "versionStartIncluding": "6.4"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A0038DE-E183-4958-A6E3-CE3821FEAFBF"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E31AD4FC-436C-44AB-BCAB-3A0B37F69EE0"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C56C6E04-4F04-44A3-8DB8-93899903CFCF"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.