CVE-2021-41073

loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.70% chance of exploitation in the next 30 days, 76th percentile

Published

2021-09-19

Updated

2024-08-04

Proof-of-concept exploits (3)

• chompie1337/Linux_LPE_io_uring_CVE-2021-41073101★ · 2022-03-08
• smallkirby/seccamp23c2-assets17★ · 2023-09-13
• WhatsWrongAndWhy/CVE-2021-41073

References

• CVE Record
• NVD entry

Related

• CVE-2020-0796
• CVE-2020-1350
• CVE-2021-3490
• CVE-2023-21768
• CVE-2023-36802
• CVE-2015-1328