Linux Kernel: io_uring local privilege escalation (CVE-2023-2598)

CVE-2023-2598 is a local privilege escalation vulnerability in the Linux kernel originating from a logic flaw in the io_uring_register_buffer function. The kernel incorrectly validates whether pages passed from user space belong to the same compound page, specifically when the same physical page is mapped into contiguous virtual addresses using mmap. This mismatch allows for an out-of-bounds read/write condition, which can be exploited to modify a process's UID in kernel memory.

Attack Chain

1. The attacker allocates a physical memory page.
2. The attacker uses mmap to map the same physical page into multiple contiguous virtual addresses.
3. The attacker initiates io_uring_register_buffer to register the buffer.
4. The kernel fails to properly validate the compound page boundaries because the virtual address mapping tricks the page_folio() check.
5. The kernel grants access to the buffer, treating it as a larger contiguous memory region than the physical allocation.
6. The attacker uses the resulting out-of-bounds write primitive to target internal process structures (e.g., cred structures).
7. The attacker modifies the uid field to zero (root) to escalate privileges.

Impact

Successful exploitation allows a local, low-privileged user to gain root privileges on the affected system. The vulnerability does not require complex address space layout randomization (ASLR) bypasses, as the exploit directly targets the credential structure.

Recommendation

1. Upgrade the Linux kernel to version 6.3.2 or later to include the necessary checks in the io_uring subsystem.
2. If an immediate kernel upgrade is not possible, restrict access to io_uring syscalls for non-privileged users via sysctl settings (e.g., kernel.io_uring_disabled=2).
3. Conduct periodic auditing of local user activity for unusual mmap and io_uring usage patterns in development or multi-tenant environments.