CVE-2023-1872

What it actually does

Use-after-free in io_uring io_file_get_fixed due to missing ctx->uring_lock, enabling race condition when fixed files are unregistered.

Why it matters to the business

Local attackers can escalate privileges on affected systems; low EPSS with no change over 30 days and no known ransomware use after 1283 days since publication indicates limited active risk but still requires patching on golang/go deployments.

How an attack unfolds

An attacker with local access triggers a race between file registration and unregistration in io_uring without the uring_lock held, causing a use-after-free that is leveraged for local privilege escalation.

How to fix it

Upgrade golang/go (GIT) past commit 7fe60b5df764f5a16a2c40e4412b5ed60f709192 or the equivalent kernel commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.

How to confirm the fix worked

Verify the running kernel or golang/go source contains commit 7fe60b5df764f5a16a2c40e4412b5ed60f709192 and test io_uring fixed-file paths under concurrent registration/unregistration.

Typical attack path

1. Obtain local user access on target system
2. Prepare io_uring fixed file operations
3. Race file unregistration against io_file_get_fixed
4. Trigger use-after-free to corrupt kernel structures
5. Escalate to root privileges

How to detect it

Review kernel audit logs and io_uring related syscalls for anomalous fixed-file registration patterns around the time of suspected activity; no named threat actors are tied to exploitation.

What your security team should do

• Apply the listed fixed commit immediately on all golang/go (GIT) instances
• Audit systems for local untrusted code execution paths that could reach io_uring
• Monitor for future Linux kernel io_uring updates