High · published January 11, 2023
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
| Product | Versions | Fixed in |
|---|---|---|
| netapp/h410s_firmware | all versions | — |
| netapp/h410c_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h300s_firmware | all versions | — |
| linux/linux_kernel | ≥ 5.4, < 5.10.160 | 5.10.160 |
| linux/linux_kernel | ≥ 5.11, < 5.12 | 5.12 |