CVE-2023-23586 (GCVE-0-2023-23586)

Vulnerability from cvelistv5 – Published: 2023-02-17 12:25 – Updated: 2025-03-12 20:08
VLAI
Title
Use after free in io_uring in the Linux Kernel
Summary
Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit  788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-12 20:08 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Kernel Affected: 5.6 , ≤ 5.10.161 (custom)
guessed Create a notification for this product.
Date Public
2022-12-22 14:30
Credits
Bing-Jhong Billy Jheng of Starlabs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:35:33.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T20:08:28.596045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T20:08:30.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "kernel",
          "product": "Linux Kernel",
          "repo": "https://git.kernel.org",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.10.161",
              "status": "affected",
              "version": "5.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Bing-Jhong Billy Jheng of Starlabs"
        }
      ],
      "datePublic": "2022-12-22T14:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDue to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.\u0026nbsp;timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring\u0027s io_worker threads, thus it is possible to insert a time namespace\u0027s vvar page to process\u0027s memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process\u0027 memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026amp;id=788d0824269bef539fe31a785b1517882eafed93\"\u003e788d0824269bef539fe31a785b1517882eafed93\u003c/a\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.\u00a0timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring\u0027s io_worker threads, thus it is possible to insert a time namespace\u0027s vvar page to process\u0027s memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process\u0027 memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit\u00a0 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring \n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-30",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-30 Hijacking a Privileged Thread of Execution"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-17T12:25:35.255Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
        },
        {
          "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Use after free in io_uring in the Linux Kernel",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2023-23586",
    "datePublished": "2023-02-17T12:25:35.000Z",
    "dateReserved": "2023-01-13T13:15:22.698Z",
    "dateUpdated": "2025-03-12T20:08:30.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-23586",
      "date": "2026-09-25",
      "epss": "0.0027",
      "percentile": "0.17081"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Linux Kernel",
                "repo": "https://git.kernel.org",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "5.10.161",
                    "status": "affected",
                    "version": "5.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cve-coordination@google.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6D163C0-5FC9-4FB8-AF75-5C27891361A0",
                    "versionEndExcluding": "5.10.161",
                    "versionStartIncluding": "5.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.\u00a0timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring\u0027s io_worker threads, thus it is possible to insert a time namespace\u0027s vvar page to process\u0027s memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process\u0027 memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit\u00a0 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring \n"
          },
          {
            "lang": "es",
            "value": "Debido a una vulnerabilidad en el subsistema io_uring, es posible filtrar informaci\u00f3n de la memoria del kernel al proceso del usuario. timens_install llama a current_is_single_threaded para determinar si el proceso actual tiene un solo subproceso, pero esta llamada no considera los subprocesos io_worker de io_uring, por lo que es posible insertar una p\u00e1gina vvar de un espacio de nombres de tiempo en el espacio de memoria del proceso a trav\u00e9s de un error de p\u00e1gina. Cuando se destruye este espacio de nombres de tiempo, la p\u00e1gina vvar tambi\u00e9n se libera, pero no se elimina de la memoria del proceso, y una p\u00e1gina siguiente asignada por el kernel todav\u00eda estar\u00e1 disponible en el proceso de espacio de usuario y puede filtrar el contenido de la memoria a trav\u00e9s de esto (leer -solo) vulnerabilidad de Use-After-Free. Recomendamos actualizar la versi\u00f3n anterior 5.10.161 o el commit 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring"
          }
        ],
        "id": "CVE-2023-23586",
        "lastModified": "2026-06-17T05:37:30.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "cve-coordination@google.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-23586",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T20:08:28.596045Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-02-17T13:15:10.737",
        "references": [
          {
            "source": "cve-coordination@google.com",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
          },
          {
            "source": "cve-coordination@google.com",
            "tags": [
              "Patch"
            ],
            "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
          }
        ],
        "sourceIdentifier": "cve-coordination@google.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "cve-coordination@google.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T15:46:20+00:00",
      "cve": "CVE-2023-23586",
      "id": "CVE-2023-23586",
      "initial_release_date": "2023-02-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io_uring: read use-after-free can lead to kernel memory leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-23586.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T10:35:33.335Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-23586",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-12T20:08:28.596045Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-12T20:08:19.093Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "kernel",
              "product": "Linux Kernel",
              "repo": "https://git.kernel.org",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThanOrEqual": "5.10.161",
                  "status": "affected",
                  "version": "5.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Bing-Jhong Billy Jheng of Starlabs"
            }
          ],
          "datePublic": "2022-12-22T14:30:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDue to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.\u0026nbsp;timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring\u0027s io_worker threads, thus it is possible to insert a time namespace\u0027s vvar page to process\u0027s memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process\u0027 memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026amp;id=788d0824269bef539fe31a785b1517882eafed93\"\u003e788d0824269bef539fe31a785b1517882eafed93\u003c/a\u003e\u003c/span\u003e\u003cbr\u003e"
                }
              ],
              "value": "Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process.\u00a0timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring\u0027s io_worker threads, thus it is possible to insert a time namespace\u0027s vvar page to process\u0027s memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process\u0027 memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit\u00a0 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring \n"
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-30",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-30 Hijacking a Privileged Thread of Execution"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "CWE-416 Use After Free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-02-17T12:25:35.255Z",
            "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
            "shortName": "Google"
          },
          "references": [
            {
              "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y\u0026id=788d0824269bef539fe31a785b1517882eafed93"
            },
            {
              "url": "https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Use after free in io_uring in the Linux Kernel",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "assignerShortName": "Google",
        "cveId": "CVE-2023-23586",
        "datePublished": "2023-02-17T12:25:35.000Z",
        "dateReserved": "2023-01-13T13:15:22.698Z",
        "dateUpdated": "2025-03-12T20:08:30.870Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.