Local privilege escalation via mismatched io_uring task identity
Published Oct 11, 2022 · Updated Aug 3, 2024
Use after free in Linux Kernel io_uring allows local users with System privileges to gain kernel privileges through asynchronous I/O. io_identity_cow assigns the current submitter's identity instead of the request originator under IORING_SETUP_IOPOLL, so cleanup drops an unacquired reference and frees a live identity. Exploitation requires local System-level execution and multiple tasks sharing a polled ring; successful memory corruption enables kernel-level privilege escalation.
Summary
What happened
Use after free in Linux Kernel io_uring allows local users with System privileges to gain kernel privileges through asynchronous I/O. io_identity_cow assigns the current submitter's identity instead of the request originator under IORING_SETUP_IOPOLL, so cleanup drops an unacquired reference and frees a live identity. Exploitation requires local System-level execution and multiple tasks sharing a polled ring; successful memory corruption enables kernel-level privilege escalation.
The record
- CVE
- CVE-2022-20409
- Published
- Oct 11, 2022
- Updated
- Aug 3, 2024
- Vendor
- The Linux Kernel Organization
- Product
- Linux Kernel
- Classifications
- CWE-416, T1068
- Attack vector
- local
- Privileges
- admin
Timeline
How it unfolded
- Oct 11, 2022CVE publishedPublication date reported by the CVE source.
- Aug 7, 2023Exploitation reportedPublic Android rooting demonstrations
- Aug 3, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=Android kernel
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- bad_io_uring Android kernel exploitweaponized · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Reported exploitation
- Public Android rooting demonstrationsreported exploitation
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo