CVE-2022-3176

What it actually does

Use-after-free in io_uring poll handling for signalfd_poll() and binder_poll() due to missing POLLFREE support on a task-lifetime waitqueue, enabling memory corruption after the queue is freed.

Why it matters to the business

Local attackers on affected Linux systems may achieve privilege escalation or system crashes, risking unauthorized access to data and disruption of services on servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access creates an io_uring instance, registers a poll on a signalfd or binder file descriptor, forces the associated waitqueue to be freed via POLLFREE notification, and leverages the resulting use-after-free for memory corruption and code execution.

How to fix it

Upgrade the Linux kernel past commit f443e374ae131c168a065ea1748feac6b2e76613; rebuild and deploy the updated kernel image, then reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit f443e374ae131c168a065ea1748feac6b2e76613 or later via git log or version string; attempt reproduction of the poll scenario in a test environment to confirm absence of the flaw.

Typical attack path

1. Obtain local user access on the target system
2. Initialize io_uring and register poll operations on signalfd or binder descriptors
3. Trigger waitqueue lifetime end to send POLLFREE
4. Exploit dangling references for arbitrary read/write or control-flow hijack
5. Escalate privileges or establish persistence

How to detect it

Review kernel audit logs and dmesg for io_uring related warnings or crashes involving signalfd or binder; correlate with process execution of tasks using io_uring syscalls around the time of any suspicious activity.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux hosts within standard patching windows
• Restrict unprivileged io_uring usage via sysctl where business needs allow
• Monitor kernel logs and process creation for anomalous io_uring activity
• Include this kernel family in routine vulnerability scanning and asset inventories