Linux Kernel Security: “io_uring: ->mm and ->files access across suid boundaries A bug in the…”

Linux Kernel Security @linkersec · 4.74K subscribers

Post #35 664 Dec 5, 2020, 14:01 UTC

io_uring: ->mm and ->files access across suid boundaries

A bug in the io_uring subsystem that allows stealing opened file descriptors from privileged processes. Reported by Jann Horn from P0. Only affects 5.8+.

https://bugs.chromium.org/p/project-zero/issues/detail?id=2089

Open in Telegram All posts from @linkersec

More from @linkersec

Sep 28, 2026PageJack in Action: CVE-2022-0995 exploit Article by Jean Vincent describing how a relativ…
Sep 21, 2026CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel Paper by Dong-ok Ki…
Sep 16, 2026Testing race conditions with memory access tracing and stack-based delay injection Article…
Sep 8, 2026SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free Article about exploiting C…
Aug 14, 2026Gone in 60 Frames – USB Video Exploitation Article (and slides) by Alex Plaskett and Rober…
Aug 11, 2026IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of…

Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →