A time-of-check to time-of-use issue exists in iouring subsystem's IORINGOP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-1295.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9eac1904d3364254d622bf2c771c4f85cd435fc2",
"digest": {
"line_hashes": [
"188105898639864729418538958958085938599",
"282747987170506721776961819324319614620",
"242767660539165623806306424604076744237",
"260435912565724800796661385072372111331",
"37396642778188391147585997252793783906",
"236593550678221582559920662707562471207",
"31395604794426257626148745665244255427",
"280563825477677009298007377253337512763",
"333155626017749026971196466926041895782",
"86122124050556336194511898565822325282",
"14237440644559337007271845121496479573",
"167675050516810493221086848583146010952",
"150728688475192916179276870827932417267",
"283277593154484759141313974240441972160",
"8654881860619648818517379168338072996",
"114438553599926850372975458114407528562",
"301425676370755385288046447085091695111",
"206625439685799892865604396204877402441",
"322864025996970559848223225600901218962",
"70676024228028399070497759332647641014",
"198799479187988040295750502100930661907",
"233859842496291309650596568654103352190",
"208246355073719243548840202262161106205",
"245381165048244695494548392351448327711",
"186556318782698902237102660381860547596",
"173145503359558436765671496875199861970",
"223814770257751774106977777021634301635",
"250764618169393837572617418324826070173",
"191114026457813480474160044305316184326",
"267785549164864189416166782920240126009",
"173863612615520142472642433602128083930",
"20529547503610555998276780041554943992",
"204057792660151767637984188456099728886",
"302519227354120936383973475365805907844",
"135018718846913695199342395920267734556",
"268207080402412165037902303243969426132",
"195152953462582759843644275444142607660",
"258288442085427072372228143069413268955",
"310907680807184995203662097295370701801",
"68925580676314974167809708127330925226",
"308506358990095596024273789505952840122",
"104223250321807591263649469147876667853"
],
"threshold": 0.9
},
"id": "CVE-2023-1295-11c25854",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb",
"digest": {
"length": 2806.0,
"function_hash": "18288031914475228439597975417856939280"
},
"id": "CVE-2023-1295-324a9cb2",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_issue_sqe"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb",
"digest": {
"line_hashes": [
"332249008763578248531711685352267530348",
"43629168565095703718123516735969986435",
"269350903340165776939494939704124702955",
"264983524336849168702001182206161607461"
],
"threshold": 0.9
},
"id": "CVE-2023-1295-3f1ec470",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/uapi/linux/io_uring.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9eac1904d3364254d622bf2c771c4f85cd435fc2",
"digest": {
"length": 664.0,
"function_hash": "166086730109944097293855715594724778712"
},
"id": "CVE-2023-1295-4a2f0e4b",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_close"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb",
"digest": {
"line_hashes": [
"233220114766288135109057581768267980367",
"184981230556581716205748139438170640399",
"232447346865301006729053821513365136360",
"16536894699335026104358314400481876487",
"278018215139046310701253733999403186000",
"27942711988868323995506620871023310781",
"203717026799070764541081923525308544944",
"288891475116629090394287887645947903618",
"23684212826082678194890685158073297022",
"108677483824600996597328640844757705634",
"304961099269846362931523432593744323587",
"119768557814969046502564311273075350928",
"145340987997147585857705435882207415214",
"188967632843925973503311357229104268621",
"103155141936913337715059766799842747597",
"202397275859388782982287207393043322276",
"256010294383567660289656604158674088131",
"271949676560031446223486747327633719582",
"212057624052237647138122615040143260457",
"147129906016755728855921498628591056380",
"6095224199159248850471556835212553198"
],
"threshold": 0.9
},
"id": "CVE-2023-1295-9c3391cb",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb",
"digest": {
"length": 1471.0,
"function_hash": "289441045562962930301828322065606857823"
},
"id": "CVE-2023-1295-aeb57670",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_defer_prep"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9eac1904d3364254d622bf2c771c4f85cd435fc2",
"digest": {
"length": 540.0,
"function_hash": "124585483114578184881183494850297761863"
},
"id": "CVE-2023-1295-d6d53c6a",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_close_prep"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb",
"digest": {
"length": 430.0,
"function_hash": "120304953415507124569114010028959736590"
},
"id": "CVE-2023-1295-e3d9c00e",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_grab_files"
}
}
]