Web: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3176

Sept. 16, 2022, 2:15 p.m. |

National Vulnerability Database nist.gov

There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659

cve

Cybersecurity Engineer

@ Apercen Partners LLC | Folsom, CA

IDM Sr. Security Developer

@ The Ohio State University | Columbus, OH, United States

IT Security Engineer

@ Stylitics | New York City

Information Security Engineer

@ VDA Labs | Remote

Information Security Analyst

@ Metropolitan Transportation Commission | San Francisco, CA

Director of Security Operations, CISO office

@ Okcoin | San Jose, California, United States

Systems Security Engineer

@ Synctera | Canada or US Remote

Cyberark Senior Consultant I | Remote, Canada

@ Optiv | Toronto, ON

Privacy & Cybersecurity Counsel

@ Brightspeed | Charlotte, NC, United States

Sr/Staff Threat Researcher

@ SecurityScorecard | Remote (US/Canada)

Consultant SOC / CERT H/F

@ Hifield | Sèvres, France

SOC Analyst

@ Starling Bank | Southampton, England, United Kingdom