CVE-2023-1583

What it actually does

NULL pointer dereference in io_file_bitmap_get within io_uring/filetable.c triggered when fixed files are unregistered without clearing file_alloc_{start,end} and alloc_hint context, followed by a request using IORING_FILE_INDEX_ALLOC auto-index selection, resulting in kernel crash.

Why it matters to the business

Unprivileged local users can trigger repeated system crashes causing denial of service and loss of availability for workloads relying on io_uring high-performance I/O, with elevated urgency for environments running older unpatched kernels.

How an attack unfolds

An attacker with local unprivileged access registers then unregisters fixed files via io_uring without clearing internal allocation context, issues a subsequent request that enables auto index selection, and forces the kernel to dereference a NULL pointer leading to a system crash; no named threat actors are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 or later; apply vendor-supplied kernel updates as soon as available and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 or is newer than the vulnerable versions; attempt to reproduce the crash scenario in a controlled test environment after patching to confirm the issue is resolved.

Typical attack path

1. Obtain local unprivileged access on a Linux system
2. Use io_uring to register and then unregister fixed files leaving allocation context uncleared
3. Submit an io_uring request with IORING_FILE_INDEX_ALLOC enabled
4. Trigger NULL pointer dereference causing kernel panic

How to detect it

Review kernel logs and dmesg output for oops or panic messages referencing io_file_bitmap_get or io_uring/filetable.c; correlate with process activity involving io_uring syscalls on systems prior to the fix commit.

• io_file_bitmap_get
• io_uring/filetable.c
• IORING_FILE_INDEX_ALLOC

What your security team should do

• Prioritize kernel updates to include commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 on all Linux systems using io_uring
• Restrict unprivileged access to io_uring interfaces where possible via system configuration
• Monitor kernel logs for oops and panic events referencing io_uring filetable functions
• Test io_uring-dependent applications after patching to ensure stability