CVE-2022-3103

What it actually does

An off-by-one error in the io_uring subsystem allows an attacker to write one byte beyond allocated buffer boundaries in kernel memory, enabling corruption of adjacent structures.

Why it matters to the business

Local users on affected Linux systems can escalate privileges to root, resulting in complete system takeover and potential data or service disruption.

How an attack unfolds

An attacker with local access crafts io_uring submission queue entries that trigger the off-by-one overflow during kernel processing, corrupting memory to redirect execution or escalate privileges.

How to fix it

Update the Linux kernel to include commit b90cb1053190353cc30f0fef0ef1f378ccc063c5 or apply the equivalent distribution patch.

How to confirm the fix worked

Confirm the running kernel source or binary contains commit b90cb1053190353cc30f0fef0ef1f378ccc063c5 and test io_uring workloads for stability under expected conditions.

Typical attack path

1. Obtain local shell access on a vulnerable Linux host
2. Prepare malicious io_uring operations targeting the vulnerable code path
3. Submit the crafted queue entries to trigger the off-by-one write
4. Leverage resulting kernel memory corruption for privilege escalation or code execution

How to detect it

Inspect kernel audit logs and system call traces for anomalous io_uring submission patterns or unexpected privilege changes following io_uring activity.

What your security team should do

• Apply the kernel update as soon as possible across all affected systems
• Consider temporarily disabling io_uring via sysctl where feasible until patched
• Review local access controls and monitoring for privilege-escalation attempts