CVE-2023-0240

What it actually does

Logic error in io_prep_async_work allows io_grab_identity to return false, causing the kernel to reuse init_cred or a prior request's identity for reference-counted operations and trigger a use-after-free.

Why it matters to the business

Local attackers on affected Linux kernels can escalate privileges to root, risking full system compromise on servers, containers, and developer workstations that rely on io_uring.

How an attack unfolds

An attacker with a local account submits carefully ordered io_uring requests that force io_grab_identity to fail; the resulting use-after-free is then leveraged through reference-count manipulation to obtain arbitrary kernel read/write and elevate to root.

How to fix it

Upgrade the Linux kernel to commit 1e6fa5216a0e59ef02e8b6b40d553238a3b81d49 or any version newer than 5.10.161; rebuild and reboot all affected hosts and container base images.

How to confirm the fix worked

Verify the running kernel contains commit 1e6fa5216a0e59ef02e8b6b40d553238a3b81d49 or is newer than 5.10.161; confirm io_uring-related test suites pass without triggering the identity-grab failure path.

Typical attack path

1. Obtain unprivileged local shell on target Linux system
2. Load or exercise io_uring syscalls to allocate and link requests
3. Trigger the identity-grab failure path to create a dangling credential reference
4. Reclaim the freed object with attacker-controlled data
5. Escalate via kernel memory corruption to obtain root credentials

How to detect it

Review kernel audit logs and io_uring-related syscalls for unusual request linking patterns; correlate with any post-exploitation activity such as unexpected credential changes or module loads.

What your security team should do

• Immediately schedule kernel upgrades on all production and build systems that expose io_uring
• Disable io_uring via sysctl where the workload permits until patches are applied
• Monitor kernel update channels for backported fixes in supported LTS branches
• Audit container images and CI pipelines for outdated kernel versions