CVE-2022-29582

What it actually does

Use-after-free vulnerability in fs/io_uring.c caused by a race condition during io_uring timeout handling that can result in memory corruption and potential arbitrary code execution in kernel context.

Why it matters to the business

Local attackers on affected Linux systems may obtain elevated privileges, potentially compromising servers, containers, and embedded devices; the issue has been public for years with public exploits available though exploitation remains unreliable.

How an attack unfolds

An attacker with local access crafts io_uring timeout operations that trigger the race window, causing the kernel to reference freed memory and enabling memory corruption that can be leveraged for privilege escalation.

How to fix it

Upgrade the Linux kernel to version 5.17.3 or later, or apply commit e677edbcabee849bfdd43f1602bccbecf736a646; rebuild and reboot all affected systems; disable io_uring via kernel command line where feasible as a temporary mitigation.

How to confirm the fix worked

Verify kernel version is at least 5.17.3; inspect /proc/version or uname output; confirm the fix commit is present in the running kernel source; test io_uring timeout workloads under concurrency to ensure no crashes occur.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Create an io_uring instance and submit carefully timed timeout requests
3. Trigger the race condition repeatedly to hit the use-after-free
4. Corrupt kernel memory structures to achieve code execution
5. Escalate privileges or escape containers

How to detect it

Review kernel logs for oops or use-after-free warnings involving io_uring; look for unusual io_uring related system calls in auditd or eBPF traces; examine crash dumps for freed memory references in fs/io_uring.c paths.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux hosts
• Monitor for new public exploits and update EPSS tracking
• Consider disabling io_uring on systems that do not require it
• Include kernel version checks in vulnerability scanning and asset inventory