io_uring fixed-buffer registration OOB physical access (CVE-2023-2598)

Aynı bug/CVE: bkz. canonical not io_uring fixed-buffer OOB physical memory access. (Not: bu slug'ın başlığı IORING_OP_PROVIDE_BUFFERS'a atıfta bulunsa da, CVE-2023-2598 gerçekte fixed-buffer registration kusurudur — yanlış opcode etiketi.)

Mechanism

CVE-2023-2598, io_sqe_buffer_register() (io_uring/rsrc.c) içindeki hatalı folio/huge-page coalescing optimizasyonudur; same-folio kontrol edilir ama physical contiguity edilmez. Tam mekanizma canonical not'ta: io_uring fixed-buffer OOB physical memory access.

Walkthrough

Tam walkthrough canonical not'ta: io-uring-fixed-buffer-oob-physical-memory-access.

References

• NVD — CVE-2023-2598
• oss-sec: Linux kernel io_uring OOB access to physical memory
• Conquering the memory through io_uring — Analysis of CVE-2023-2598 (anatomic.rip)