CVE-2022-29582: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-29582 is a use-after-free vulnerability discovered in the Linux kernel's io_uring subsystem, affecting versions 5.10+ before 5.17.3. The vulnerability was discovered by Jayden Rivers and David Bouman and disclosed in April 2022. The issue occurs due to a race condition in io_uring timeouts, specifically when IORING_OP_TIMEOUT and IORING_OP_LINK_TIMEOUT opcodes are combined in a linked submission queue entry (Openwall List, NVD).

The vulnerability arises when a timeout request (T) and a link timeout request (LT) are combined, and another request (B) completes. A race condition occurs when T is cancelled through the completion event count while LT is simultaneously canceled by its hrtimer. During T's cleanup, LT is freed by a different execution context, but since they are linked, T retains a dangling reference to the freed LT, resulting in a use-after-free condition. The issue was fixed in Linux kernel 5.17.3 through commit e677edbcabee849bfdd43f1602bccbecf736a646 (Kernel Commit, Openwall List).

The vulnerability can be exploited by an unprivileged local attacker to achieve local privilege escalation to root, even from within a container. Unlike many other Linux vulnerabilities, this one does not require any special privileges (such as user namespace access) to exploit, making it particularly dangerous (Openwall List, Debian Security).

While the vulnerability is exploitable, the race window is quite tight and the scenario is complicated, making successful exploitation infrequent. A proof-of-concept exploit has been developed that can elevate privileges to system root from an unprivileged process. The exploit technique involves reallocating the freed LT to another struct io_kiocb and deferring the use-after-free to a struct file (Exploit Repository, Openwall List).

The primary mitigation is to upgrade to Linux kernel version 5.17.3 or later, which contains the fix. The patch modifies io_flush_timeouts() to leave the timeout on the list and let the normal timeout cancelation handle it, rather than unconditionally removing it from the timeout list (Kernel Commit, Debian Security).