CVE-2020-29534: Linux io_uring SUID Boundary ->mm and ->files Access Vulnerability

Key Information Vulnerability Description Vulnerability Name: Linux io_uring: ->mm and ->files access across suid boundaries CVE ID: CVE-2020-29534 Affected Versions: - The first issue appears in Linux 5.8.x and later versions. - The second issue is reproducible only on the Linus git version (commit 729e3d901984). Fix Date: November 1, 2020 Main Issues 1. ->files Access Across SUID Boundaries: - acquires a non-incremented reference count when submitting requests, relying on to notify before the structure is freed. - uses via , unaware of this behavior, and incorrectly assumes that when is 1, the old can still be safely used. - Attackers can exploit this vulnerability to tamper with the file descriptor table of privileged processes, particularly by using to steal file descriptors. 2. ->mm Access Across SUID Boundaries: - The first proof-of-concept (PoC) does not work on the git main branch; the operation fails because it attempts to read from the of a SUID binary. - The suspected issue is that is scheduled from the task work queue, which runs in the context of the SUID binary and captures the pointer from the task work context. Additional Information Priority: P2 Severity: S1 Discovery Method: Source code review Reporter: ja...@google.com Verifier: pr...@google.com Mitigation Recommendations Add a boolean flag to to indicate that it should not be reclaimed even if is 1. Provide an additional special notification hook in for to allow it to drop its reference.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-29534: Linux io_uring SUID Boundary ->mm and ->files Access Vulnerability