CVE-2022-1043 : A flaw was found in the Linux kernel’s io

A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges.

Published 2022-08-29 15:15:10

Updated 2023-02-02 17:13:40

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-1043

Linux » Linux Kernel
Versions from including (>=) 5.10.51 and before (<) 5.10.61
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.11 and before (<) 5.13.13
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-1043

Top countries where our scanners detected CVE-2022-1043

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2022-1043 1,421

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-1043!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-1043

EPSS FAQ

8.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-1043

io_uring Same Type Object Reuse Priv Esc

Disclosure Date: 2022-03-22

First seen: 2023-09-11

exploit/linux/local/cve_2022_1043_io_uring_priv_esc

This module exploits a bug in io_uring leading to an additional put_cred() that can be exploited to hijack credentials of other processes. We spawn SUID programs to get the free'd cred object reallocated by a privileged process and abuse them to create a SUI

More information

CVSS scores for CVE-2022-1043

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-1043

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)

References for CVE-2022-1043

https://access.redhat.com/security/cve/CVE-2022-1043

CVE-2022-1043- Red Hat Customer Portal
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-362/

ZDI-22-362 | Zero Day Initiative
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/170834/io_uring-Same-Type-Object-Reuse-Privilege-Escalation.html

io_uring Same Type Object Reuse Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/torvalds/linux/commit/a30f895ad3239f45012e860d4f94c1a388b36d14

io_uring: fix xa_alloc_cycle() error return value check · torvalds/linux@a30f895 · GitHub
Patch;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1997328

1997328 – (CVE-2022-1043) CVE-2022-1043 kernel: Linux Kernel io_uring Use-After-Free Privilege Escalation Vulnerability
Issue Tracking;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-1043