CVE-2021-41073 is a privilege escalation vulnerability in the Linux kernel versions 5.10 through 5.14.6, specifically within the io_uring subsystem, affecting distributions like Debian and Fedora. A local attacker can exploit a use-after-free condition in loop_rw_iter by manipulating IORING_OP_PROVIDE_BUFFERS to free a kernel buffer, leading to full compromise of confidentiality, integrity, and availability. Rated with a CVSS score of 7.8 (High), it requires local access but has low attack complexity and no user interaction. Currently, there is no public exploit code available, nor is there evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.10, < 5.10.68CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.14.7CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
kernel: local user privilege escalation via loop_rw_iter in fs/io_uring.c
Sep 19, 2021loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer as demonstrated by using /proc/<pid>/maps for exploitation.
Sep 14, 2021