allow io_uring to be disabled in runtime
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
linux (Ubuntu) | Status tracked in Mantic | |||||
Focal |
Fix Committed
|
Medium
|
Thadeu Lima de Souza Cascardo | |||
Jammy |
Fix Committed
|
Medium
|
Thadeu Lima de Souza Cascardo | |||
Lunar |
Fix Committed
|
Medium
|
Thadeu Lima de Souza Cascardo | |||
Mantic |
Fix Committed
|
Medium
|
Thadeu Lima de Souza Cascardo | |||
linux-oem-6.1 (Ubuntu) | Status tracked in Mantic | |||||
Focal |
Invalid
|
Undecided
|
Unassigned | |||
Jammy |
Fix Released
|
Undecided
|
Unassigned | |||
Lunar |
Invalid
|
Undecided
|
Unassigned | |||
Mantic |
Invalid
|
Undecided
|
Unassigned |
Bug Description
[Impact]
io_uring has been an important attack vector in the recent years in local privilege escalation attacks. Allowing admins that don't use io_uring to disable it in their systems allows them to reduce their attack surface.
[Test case]
sysctl -w kernel.
then try to use io_uring from an unprivileged user, then try it with privileges (CAP_SYS_ADMIN)
Actually also tried setting kernel.
neither (privileged or unprivileged worked).
Then testing setting it back to 0.
Then tested with io_uring_disabled set to 1 and io_uring_group=1000 and
that it worked for group 1000, then set it to 1001 and verified that it
didn't work anymore for group 1000.
[Potential regression]
Uses can be denied from using io_uring.
CVE References
Changed in linux (Ubuntu Focal): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Jammy): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Lunar): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Mantic): | |
importance: | Undecided → Medium |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Lunar): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Jammy): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Focal): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Mantic): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Lunar): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Jammy): | |
status: | Incomplete → Triaged |
Changed in linux (Ubuntu Focal): | |
status: | Incomplete → Triaged |
description: | updated |
Changed in linux-oem-6.1 (Ubuntu Jammy): | |
status: | New → Fix Committed |
Changed in linux-oem-6.1 (Ubuntu Focal): | |
status: | New → Invalid |
Changed in linux-oem-6.1 (Ubuntu Lunar): | |
status: | New → Invalid |
Changed in linux-oem-6.1 (Ubuntu Mantic): | |
status: | New → Invalid |
Changed in linux (Ubuntu Lunar): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Mantic): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Jammy): | |
status: | Triaged → Fix Committed |
Changed in linux (Ubuntu Focal): | |
status: | Triaged → Fix Committed |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 2035116
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.