io_uring reference-counting UAF (CVE-2021-20226)

Aynı bug/CVE: bkz. canonical io_uring reference counting bug (CVE-2021-20226).

Mechanism

Bu not, canonical ile aynı io_grab_files() reference-counting bug'ını (fdget() fast path'iyle birleşik struct file use-after-free) tarif eder. Tam mekanizma için bkz. io_uring reference counting bug (CVE-2021-20226).

Walkthrough

Tam walkthrough canonical not'ta: io_uring reference counting bug (CVE-2021-20226).

References

• CVE-2021-20226: a reference counting bug which leads to LPE in io_uring (GMO Flatt Security)
• CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem (Zero Day Initiative)
• oss-security — CVE-2021-20226 use-after-free in io_uring