HighPublic exploit

Uninitialized Variable in io_uring (Linux Kernel <=5.17.5)

IdentifiersCVE-2022-29968CWE-908

CVE-2022-29968 is a vulnerability in the Linux kernel (through 5.17.5) within the io_uring subsystem. The function io_rw_init_file in fs/io_uring.c fails to initialize the kiocb->private field, potentially leaving it with stale or unintended data. This can lead to unpredictable behavior depending on how the uninitialized field is subsequently used.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

The impact depends on the usage of the uninitialized kiocb->private field. It may result in information disclosure, privilege escalation, or kernel memory corruption, depending on the context in which the field is accessed. The risk is heightened in environments where unprivileged users can trigger io_uring operations.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to io_uring functionality to trusted users only, and monitor for kernel updates addressing this vulnerability. Consider disabling io_uring if not required until a patched kernel is deployed.

Remediation

Patch, then assume compromise.

Upgrade to a Linux kernel version where this issue is patched. Ensure that all fields, especially kiocb->private, are properly initialized in io_rw_init_file within fs/io_uring.c.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2022-29968MaturityOperationalVerified exploit

This repository contains a proof-of-concept exploit for CVE-2022-29968, an uninitialized memory vulnerability in the Linux kernel's io_uring subsystem. The exploit targets kernels after commit 3e08773c3841 and before 32452a3eb8b6. The repository includes several C source files: 'exploit.c' (main exploit logic), 'fake_bio.c' (sets up a fake bio structure for kernel memory corruption), 'spray.c' and 'userfaultfd_spray.c' (used to spray memory and manipulate kernel allocations), and 'io_uring.h' (header for io_uring structures). The exploit works by spraying user-controlled data, triggering the kernel bug via io_uring, and hijacking kernel execution to overwrite the credentials of the parent process, resulting in privilege escalation to root. The exploit requires local access, a vulnerable kernel, and read access to /dev/sr0. The Makefile automates compilation. Several crash logs are included for debugging and analysis. The exploit is operational and demonstrates a full privilege escalation chain.

jprxDisclosed Apr 19, 2022cmakefilelocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Fedora ProjectFedoraoperating_system

LinuxLinux Kerneloperating_system

NetAppH300s Firmwareoperating_system

NetAppH410c Firmwareoperating_system

NetAppH410s Firmwareoperating_system

NetAppH500s Firmwareoperating_system

NetAppH700s Firmwareoperating_system

NetAppSolidfire & Hci Management Nodeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

ghsa syntheticNews

May 3, 2022

GHSA-p7mv-crf9-43g9

An initialization flaw in the Linux kernel through version 5.17.5: io_rw_init_file in fs/io_uring.c does not initialize kiocb->private. The reference does not describe the security impact or exploitation requirements.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity