io_uring loop_rw_iter type confusion / incorrect free (CVE-2021-41073)

Aynı bug/CVE: bkz. canonical io_uring UAF (CVE-2021-41073). loop_rw_iter() bir kernel io_buffer pointer'ını koşulsuz ilerletir → kmalloc-32'de kontrollü free → use-after-free LPE.

Mechanism

Bu, canonical not'taki teknikle aynı kök nedendir: provided-buffers / IOSQE_BUFFER_SELECT ile req->rw.addr bir kernel io_buffer pointer'ı olur ve loop_rw_iter() setup/advance simetrisini kıracak şekilde onu ilerletir. Tam açıklama: io_uring UAF (CVE-2021-41073).

Walkthrough

Tam walkthrough canonical not'ta: io_uring UAF (CVE-2021-41073).

References

• io_uring — new code, new bugs, and a new exploit technique (STAR Labs)
• CVE-2021-41073 Detail (NVD)
• Linux_LPE_io_uring_CVE-2021-41073 (chompie1337)
• io_uring: ensure symmetry in handling iter types in loop_rw_iter() (lkml)