Linux io_uring Race Enables Kernel Privilege Escalation in kernelCTF Demo
· 39:37 · Watch on YouTube ↗
Summary
Pumpkin explains a Linux io_uring race in buffer upgrades that can cause a use-after-free and map arbitrary kernel memory, then demonstrates privilege escalation in kernelCTF. The fix allocates a new buffer object instead of reusing one.
Key points
- The talk examines Linux io_uring’s shared-buffer design and how concurrent access can expose memory-management flaws.
- The featured race occurs when an empty provided buffer is upgraded while another process maps it; reinitializing its reference count can leave a freed object accessible.
- The use-after-free can allow the attacker to redirect the buffer pointer and map arbitrary kernel memory with write permissions.
- Pumpkin demonstrates exploiting the race to gain root in the kernelCTF environment, using concurrent threads, timing, and object reclaim techniques.
- The presenter says the fix allocates a new buffer object during upgrades rather than reusing the existing provided buffer.
- A key lesson is that RCU delays freeing objects but does not prevent concurrent modification of their fields.
Article Details
- Topics
- [01:43] io_uring architecture and shared-buffer design
- [09:06] Earlier io_uring memory-sharing vulnerabilities and mitigations
- [14:32] Lock dependency, RCU, and concurrent buffer access
- [24:49] The buffer-upgrade race and its use-after-free
- [29:48] Exploitation steps and privilege escalation in kernelCTF
- [38:11] The fix and lessons about reference counts and RCU