Linux Kernel: io_uring privilege escalation (CVE-2024-0582)

A proof-of-concept exploit for CVE-2024-0582 has been published, targeting a use-after-free vulnerability within the Linux kernel io_uring subsystem during buffer ring unregistration. The exploit utilizes a "Dirty Cred" approach to corrupt kernel structures, specifically modifying the f_mode flags of file descriptors to grant write access to protected files, including /etc/passwd. Successful exploitation allows a local attacker to escalate privileges to root by injecting a backdoor entry into /etc/passwd.

Attack Chain

1. Set CPU affinity and raise file descriptor limits to ensure exploit stability.
2. Initialize an io_uring instance and register a buffer ring in kernel memory.
3. Unregister the buffer ring to trigger the use-after-free vulnerability.
4. Perform a file descriptor spray to target the /etc/passwd file descriptor.
5. Corrupt the f_mode flags of the target file descriptor to make /etc/passwd writable.
6. Append a custom root user backdoor entry to /etc/passwd.

Impact

Successful exploitation grants a local user full root privileges. The exploit requires local access and can be used to bypass system integrity by modifying sensitive configuration files.

Recommendation

• Audit kernel versions across the environment to identify systems running Linux Kernel versions < 6.6.5 or 6.7.
• Prioritize patching affected Linux kernels to the latest available stable release.
• Deploy monitoring for unauthorized or anomalous modifications to /etc/passwd.
• Restrict the use of io_uring for non-privileged users if the workload allows, as it is a common vector for local privilege escalation.