CVE-2022-2327

What it actually does

Missing work_flags handling in io_uring for certain operations causes incorrect reference counts on process identity objects, resulting in a double-free condition during IORING_OP execution.

Why it matters to the business

Local attackers can trigger kernel memory corruption leading to system crashes, denial of service, or potential privilege escalation on Linux systems, increasing operational risk and requiring urgent kernel updates across fleets.

How an attack unfolds

A local attacker with low privileges submits crafted io_uring submission queue entries that omit required identity work_flags; the kernel performs an incomplete reference grab, allowing a subsequent double-free that an attacker can leverage for arbitrary code execution or memory manipulation.

How to fix it

Upgrade the Linux kernel to a version containing commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 or any later mainline or distribution backport that fully addresses the missing work_flags cases for all IORING_OP types.

How to confirm the fix worked

Verify the running kernel includes the referenced commit via git log or distribution changelog; confirm absence of the vulnerable code paths in io_uring.c related to work_flags and identity handling.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Use io_uring syscalls to submit operations missing required work_flags
3. Trigger reference count imbalance leading to double-free
4. Leverage resulting use-after-free for kernel memory corruption or escalation

How to detect it

Review kernel logs (dmesg, syslog) for double-free warnings or slab corruption messages involving io_uring work items; inspect audit records for unusual io_uring syscall patterns from non-root users.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux hosts within the next patching cycle
• Consider disabling io_uring via sysctl where the feature is not required
• Monitor kernel crash reports and audit logs for io_uring-related memory errors