CVE-2023-1583

Published: 24 March 2023

A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.

From the Ubuntu Security Team

It was discovered that the io_uring subsystem in the Linux kernel did not properly perform file table updates in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1583
• https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commit/?h=io_uring-6.3&id=761efd55a0227aca3a69deacdaa112fffd44fe37
• https://ubuntu.com/security/notices/USN-6033-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2180970
• https://bugzilla.suse.com/show_bug.cgi?id=1209637