There exists a use-after-free in... CVE-2022-3176
-
AV
AC
AU
C
I
A
发布：
2022-09-16
修订：
2024-11-21
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
漏洞利用/PoC
暂无可用Exp或PoC
受影响的平台与产品
当前有7条受影响产品信息
