CVE-2023-3389

What it actually does

Use-after-free in the io_uring hrtimer path triggered by racing a cancel poll request against a linked timeout, enabling kernel memory corruption and local privilege escalation to root.

Why it matters to the business

Local attackers can obtain full administrative control over Linux systems, resulting in data theft, persistence, or disruption of services; moderate urgency due to low EPSS, stable trend, and absence from known exploited lists or ransomware campaigns.

How an attack unfolds

An attacker with local access prepares an io_uring submission queue containing a poll request linked to a timeout, then races a cancellation against the timeout to trigger the hrtimer use-after-free and corrupt kernel structures for privilege escalation. No named threat actors or campaigns are associated.

How to fix it

Upgrade the Linux kernel past commit ef7dfac51d8ed961b742218f526bd589f3900a59; for 5.10 stable apply 4716c73b188566865bdd79c3a6709696a224ac04 and for 5.15 stable apply 0e388fce7aec40992eadee654193cad345d62663.

How to confirm the fix worked

Confirm the running kernel contains the listed commit hashes or newer; exercise io_uring workloads and inspect for absence of prior UAF symptoms in kernel logs.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Load and configure io_uring rings with poll and linked timeout operations
3. Trigger the race between poll cancellation and timeout expiration
4. Leverage the resulting hrtimer UAF for kernel memory corruption
5. Escalate privileges to root and execute payload

How to detect it

Review kernel logs (dmesg, syslog) for hrtimer or io_uring related warnings or crashes coinciding with unexpected privilege changes; correlate with audit records of io_uring syscalls from non-root processes.

What your security team should do

• Apply kernel updates to all affected Linux distributions and embedded devices
• Disable or restrict unprivileged io_uring via kernel boot parameters where feasible
• Monitor kernel logs and audit trails for anomalous io_uring activity
• Prioritize patching on multi-tenant or high-value servers given the local escalation impact