CVE-2022-3910
HIGHLinux Kernel 5.18-5.19.10 - Use-After-Free in io_uring Fixed File Handling
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-3910. PoCs published by veritas501, TLD1027.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2022-3910, a Linux kernel vulnerability involving use-after-free (UAF) in the io_uring subsystem. The exploits demonstrate privilege escalation via dirty pipe-like techniques, manipulating file descriptors and memory mappings.
Description
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679
Exploits (2)
This repository contains functional exploit code for CVE-2022-3910, a Linux kernel vulnerability involving use-after-free (UAF) in the io_uring subsystem. The exploits demonstrate privilege escalation via dirty pipe-like techniques, manipulating file descriptors and memory mappings.
This repository contains functional exploit code for CVE-2022-3910, a Linux kernel vulnerability leveraging DirtyCred and cross-cache techniques for local privilege escalation. The PoC includes detailed memory manipulation and kernel object reuse to achieve arbitrary read/write primitives.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H