io_uring/rw: free potentially allocated iovec on cache put failure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.18.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From a9165b83c1937eeed1f0c731468216d6371d647f · fixed in 41cda4c66846c3bfcdeaf28444ccabbb55e64cf1; From a9165b83c1937eeed1f0c731468216d6371d647f · fixed in 1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c; From a9165b83c1937eeed1f0c731468216d6371d647f · fixed in 4b9748055457ac3a0710bf210c229d01ea1b01b9
- Linux Linux
6.10
- KernelLinux
From 6.10.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.10