High · published May 14, 2024
In the Linux kernel, the following vulnerability has been resolved:
io_uring/af_unix: disable sending io_uring over sockets
File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.4.220, < 5.4.264 | 5.4.264 |
| linux/linux_kernel | ≥ 5.10.150, < 5.10.204 | 5.10.204 |
| linux/linux_kernel | ≥ 5.15.75, < 5.15.143 | 5.15.143 |
| linux/linux_kernel | ≥ 5.19.17, < 5.20 | 5.20 |
| linux/linux_kernel | ≥ 6.0.3, < 6.1.68 | 6.1.68 |
| linux/linux_kernel | ≥ 6.2, < 6.6.7 | 6.6.7 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |