Recently Redhat announced the vulnerability CVE-2022-3910 (CVSS score: 7.4) στον πυρήνα του Linux. Πρόκειται για ένα σφάλμα που υπάρχει στην ενημέρωση του Reference Count στο io_uring.
io_uring is a system call interface for Linux. It first came in version 5.1 of the Linux kernel in 2019. It allows an application to initiate system calls that can be executed asynchronously.
In the Linux kernel, an incorrect reference count update to io_uring leads to Use-After-Free and local privilege escalation. When io_msg_ring is called with a fixed file, it calls io_fput_file() which incorrectly decrements its reference count. Fixed files are permanently registered and should not be run separately.
Bug CVE-2022-3910 was fixed a few hours ago.
Προς το παρόν, οι προγραμματιστές του kernel έχουν εκδώσει επίσημο update ασφαλείας.
Users are advised to update servers immediately and apply patches for other distributions as soon as they are available. It is also recommended that they only allow access to local systems to trusted users and always monitor their systems.
