allow io_uring to be disabled in runtime

Bug #2035116 reported by Thadeu Lima de Souza Cascardo
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Status tracked in Mantic
Focal
Fix Committed
Medium
Thadeu Lima de Souza Cascardo
Jammy
Fix Committed
Medium
Thadeu Lima de Souza Cascardo
Lunar
Fix Committed
Medium
Thadeu Lima de Souza Cascardo
Mantic
Fix Committed
Medium
Thadeu Lima de Souza Cascardo
linux-oem-6.1 (Ubuntu)
Status tracked in Mantic
Focal
Invalid
Undecided
Unassigned
Jammy
Fix Released
Undecided
Unassigned
Lunar
Invalid
Undecided
Unassigned
Mantic
Invalid
Undecided
Unassigned

Bug Description

[Impact]
io_uring has been an important attack vector in the recent years in local privilege escalation attacks. Allowing admins that don't use io_uring to disable it in their systems allows them to reduce their attack surface.

[Test case]
sysctl -w kernel.io_uring_disabled=1
then try to use io_uring from an unprivileged user, then try it with privileges (CAP_SYS_ADMIN)

Actually also tried setting kernel.io_uring_disabled=2 and checking that
neither (privileged or unprivileged worked).

Then testing setting it back to 0.

Then tested with io_uring_disabled set to 1 and io_uring_group=1000 and
that it worked for group 1000, then set it to 1001 and verified that it
didn't work anymore for group 1000.

[Potential regression]
Uses can be denied from using io_uring.

CVE References

Changed in linux (Ubuntu Focal):
importance: Undecided → Medium
Changed in linux (Ubuntu Jammy):
importance: Undecided → Medium
Changed in linux (Ubuntu Lunar):
importance: Undecided → Medium
Changed in linux (Ubuntu Mantic):
importance: Undecided → Medium
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
Changed in linux (Ubuntu Lunar):
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
Changed in linux (Ubuntu Jammy):
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
Changed in linux (Ubuntu Focal):
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 2035116

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Changed in linux (Ubuntu Focal):
status: New → Incomplete
Changed in linux (Ubuntu Jammy):
status: New → Incomplete
Changed in linux (Ubuntu Lunar):
status: New → Incomplete
Changed in linux (Ubuntu Mantic):
status: Incomplete → In Progress
Changed in linux (Ubuntu Lunar):
status: Incomplete → In Progress
Changed in linux (Ubuntu Jammy):
status: Incomplete → Triaged
Changed in linux (Ubuntu Focal):
status: Incomplete → Triaged
description: updated
Timo Aaltonen (tjaalton)
Changed in linux-oem-6.1 (Ubuntu Jammy):
status: New → Fix Committed
Changed in linux-oem-6.1 (Ubuntu Focal):
status: New → Invalid
Changed in linux-oem-6.1 (Ubuntu Lunar):
status: New → Invalid
Changed in linux-oem-6.1 (Ubuntu Mantic):
status: New → Invalid
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-oem-6.1/6.1.0-1023.23 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-oem-6.1' to 'verification-done-jammy-linux-oem-6.1'. If the problem still exists, change the tag 'verification-needed-jammy-linux-oem-6.1' to 'verification-failed-jammy-linux-oem-6.1'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-oem-6.1-v2 verification-needed-jammy-linux-oem-6.1
Stefan Bader (smb)
Changed in linux (Ubuntu Lunar):
status: In Progress → Fix Committed
Changed in linux (Ubuntu Mantic):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (60.3 KiB)

This bug was fixed in the package linux-oem-6.1 - 6.1.0-1023.23

---------------
linux-oem-6.1 (6.1.0-1023.23) jammy; urgency=medium

  * jammy/linux-oem-6.1: 6.1.0-1023.23 -proposed tracker (LP: #2033827)

  * Jammy update: v6.1.53 upstream stable release (LP: #2035359)
    - Revert "bridge: Add extack warning when enabling STP in netns."
    - Partially revert "drm/amd/display: Fix possible underflow for displays with
      large vblank"
    - scsi: ufs: Try harder to change the power mode
    - Revert "Revert drm/amd/display: Enable Freesync Video Mode by default"
    - ARM: dts: imx: Set default tuning step for imx7d usdhc
    - powerpc/boot: Disable power10 features after BOOTAFLAGS assignment
    - media: uapi: HEVC: Add num_delta_pocs_of_ref_rps_idx field
    - Revert "MIPS: unhide PATA_PLATFORM"
    - phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
    - media: amphion: use dev_err_probe
    - media: pulse8-cec: handle possible ping error
    - media: pci: cx23885: fix error handling for cx23885 ATSC boards
    - 9p: virtio: fix unlikely null pointer deref in handle_rerror
    - 9p: virtio: make sure 'offs' is initialized in zc_request
    - ksmbd: fix out of bounds in smb3_decrypt_req()
    - ksmbd: validate session id and tree id in compound request
    - ksmbd: no response from compound read
    - ksmbd: fix out of bounds in init_smb2_rsp_hdr()
    - ASoC: da7219: Flush pending AAD IRQ when suspending
    - ASoC: da7219: Check for failure reading AAD IRQ events
    - ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect
    - ethernet: atheros: fix return value check in atl1c_tso_csum()
    - m68k: Fix invalid .section syntax
    - s390/dasd: use correct number of retries for ERP requests
    - s390/dasd: fix hanging device after request requeue
    - fs/nls: make load_nls() take a const parameter
    - ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0
    - ASoc: codecs: ES8316: Fix DMIC config
    - ASoC: rt711: fix for JD event handling in ClockStop Mode0
    - ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0
    - ASoC: atmel: Fix the 8K sample parameter in I2SC master
    - ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset
    - platform/x86: intel: hid: Always call BTNL ACPI method
    - platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks
    - platform/x86: think-lmi: Use kfree_sensitive instead of kfree
    - platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops
    - platform/x86: huawei-wmi: Silence ambient light sensor
    - drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr Clock
    - drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family
    - drm/amd/display: Exit idle optimizations before attempt to access PHY
    - ovl: Always reevaluate the file signature for IMA
    - ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
    - ALSA: usb-audio: Update for native DSD support quirks
    - staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER
    - security: keys: perform capable check only on privileged operations
    - kprobes: Prohibit probing on CFI preamble s...

Changed in linux-oem-6.1 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Stefan Bader (smb)
Changed in linux (Ubuntu Jammy):
status: Triaged → Fix Committed
Changed in linux (Ubuntu Focal):
status: Triaged → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/5.15.0-88.98 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux' to 'verification-done-jammy-linux'. If the problem still exists, change the tag 'verification-needed-jammy-linux' to 'verification-failed-jammy-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-v2 verification-needed-jammy-linux
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/5.4.0-166.183 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux' to 'verification-done-focal-linux'. If the problem still exists, change the tag 'verification-needed-focal-linux' to 'verification-failed-focal-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-v2 verification-needed-focal-linux
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/6.2.0-36.37 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lunar-linux' to 'verification-done-lunar-linux'. If the problem still exists, change the tag 'verification-needed-lunar-linux' to 'verification-failed-lunar-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-lunar-linux-v2 verification-needed-lunar-linux
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.