Cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3anetapphci_baseboard_management_controllerh300s/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 05:59:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel: io_uring local privilege escalation (CVE-2023-2598)https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe-cve-2023-2598/Thu, 29 Oct 2026 05:59:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe-cve-2023-2598/A privilege escalation vulnerability in the Linux kernel io_uring subsystem caused by incorrect compound page validation allows local attackers to achieve out-of-bounds memory access and modify process credentials.CVE-2023-2598 is a local privilege escalation vulnerability in the Linux kernel originating from a logic flaw in the io_uring_register_buffer function. The kernel incorrectly validates whether pages passed from user space belong to the same compound page, specifically when the same physical page is mapped into contiguous virtual addresses using mmap. This mismatch allows for an out-of-bounds read/write condition, which can be exploited to modify a process's UID in kernel memory.

Attack Chain

  1. The attacker allocates a physical memory page.
  2. The attacker uses mmap to map the same physical page into multiple contiguous virtual addresses.
  3. The attacker initiates io_uring_register_buffer to register the buffer.
  4. The kernel fails to properly validate the compound page boundaries because the virtual address mapping tricks the page_folio() check.
  5. The kernel grants access to the buffer, treating it as a larger contiguous memory region than the physical allocation.
  6. The attacker uses the resulting out-of-bounds write primitive to target internal process structures (e.g., cred structures).
  7. The attacker modifies the uid field to zero (root) to escalate privileges.

Impact

Successful exploitation allows a local, low-privileged user to gain root privileges on the affected system. The vulnerability does not require complex address space layout randomization (ASLR) bypasses, as the exploit directly targets the credential structure.

Recommendation

  1. Upgrade the Linux kernel to version 6.3.2 or later to include the necessary checks in the io_uring subsystem.
  2. If an immediate kernel upgrade is not possible, restrict access to io_uring syscalls for non-privileged users via sysctl settings (e.g., kernel.io_uring_disabled=2).
  3. Conduct periodic auditing of local user activity for unusual mmap and io_uring usage patterns in development or multi-tenant environments.
]]>highadvisorylinuxkernelprivilege-escalationcve