CVE-2025-10824: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-10824 is a heap use-after-free vulnerability in axboe fio (Flexible I/O Tester) affecting all versions up to and including 3.41. The flaw resides in the __parse_jobs_ini function within init.c, where an options array is freed but subsequently accessed during option sorting, triggering a use-after-free condition. It was discovered by a security researcher using fuzzing techniques and reported on September 11, 2025, with the CVE published on September 22, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 score of 1.9 (Low) as assessed by VulDB (VulDB, GitHub Issue).

The root cause is a use-after-free (CWE-416) combined with improper memory buffer handling (CWE-119) in fio's INI job file parser. In __parse_jobs_ini() (init.c, around line 2302), an opts array is allocated and then freed; however, a reference to this freed array is subsequently passed to fio_options_parse() (options.c:5912), which calls sort_options(), which in turn invokes qsort() with the comparator opt_cmp() (parse.c:1139). The opt_cmp() function dereferences entries from the already-freed opts array, causing the heap-use-after-free. Exploitation requires a locally accessible crafted fio job configuration file and low-privilege local access; no network access is required. A proof-of-concept (poc.zip) has been publicly disclosed via the GitHub issue tracker (GitHub Issue).

Successful exploitation could result in limited confidentiality, integrity, and availability impacts on the local system, as reflected in the CVSS scoring (low impact across all three dimensions). In practice, a use-after-free of this nature could potentially be leveraged for arbitrary code execution or privilege escalation, though the constrained local attack vector and low-privilege requirement limit the realistic blast radius. The vulnerability affects systems running fio versions 3.0 through 3.41, including Microsoft's CBL-Mariner (cbl2_fio_3.30-2) and Azure Linux 3 (azl3_fio_3.37-2) packages (VulDB, Microsoft MSRC).

A proof-of-concept exploit file (poc.zip) was publicly disclosed alongside the GitHub issue report, demonstrating the crash under AddressSanitizer on Ubuntu 22.04 (GitHub Issue). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (VulDB).

1. Prepare environment: Obtain a local account with low-level privileges on a system running fio version ≤ 3.41.
2. Craft malicious job file: Create a specially crafted fio INI-format job configuration file (as demonstrated in the public poc.zip) designed to trigger the specific code path in __parse_jobs_ini() that frees the opts array prematurely.
3. Invoke fio with crafted input: Execute fio with the crafted file, e.g., ./fio --parse-only poc, causing the parser to allocate and free the opts array, then pass the freed pointer to fio_options_parse().
4. Trigger use-after-free: The freed opts array is accessed by opt_cmp() via qsort() in sort_options(), resulting in a heap-use-after-free condition that can cause a crash or, under specific heap layout conditions, potentially redirect execution flow (GitHub Issue).

• Process: Unexpected crashes or segmentation faults in the fio process, particularly during job file parsing; crash dumps referencing opt_cmp, sort_options, or fio_options_parse in the stack trace.
• File System: Presence of unusual or malformed fio job configuration files (.fio or INI-format files) in directories accessible to low-privilege users.
• Logs: System logs (e.g., /var/log/syslog, kernel logs) showing repeated abnormal termination of the fio binary; AddressSanitizer output referencing heap-use-after-free at parse.c:1139 if fio is built with sanitizers.

Users should update fio to a version beyond 3.41 once a patched upstream release is available. Microsoft has issued security updates for affected Azure Linux packages (cbl2_fio_3.30-2 and azl3_fio_3.37-2) via the Microsoft Security Response Center (Microsoft MSRC). As a workaround, restrict local user access to fio and avoid running fio with untrusted job configuration files. Apply the principle of least privilege to limit which users can execute fio on sensitive systems.

Red Hat has acknowledged the vulnerability and published a security advisory tracking it (Red Hat CVE). Tenable has added detection support via Nessus plugin 266033 (Tenable). No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation.