Vulnerability feed

Executive summary

A flaw in the Linux kernel's io_uring connect filter lets certain IPv6 connection attempts bypass filters that block IPv6 ports or addresses. The advisory says the filter sees zero port and address values while the kernel connects to the real destination. The advisory presents the fix as a stable-tree patch, but it does not state a severity rating or a CVSS score.

Technical summary

The weakness is a logic error in io_connect_bpf_populate(), where the filter fields connect.port and connect.v6_addr are populated only when addr_len is at least sizeof(struct sockaddr_in6), which is 28 bytes. The IPv6 stack accepts 24-byte addresses (SIN6_LEN_RFC2133), so a connect issued with addr_len 24 is seen by the filter as port and address zero while the real destination is contacted, bypassing port or address denial rules. The attacker precondition is a local ability to issue IORING_OP_CONNECT under a filter, and the advisory does not describe a remote vector. The fix changes the threshold to SIN6_LEN_RFC2133 in io_uring/net.c, and the advisory says the code is present in 7.2 and the fix is tagged for stable 7.2. Affected version ranges, fixed version numbers beyond the commit reference, CVSS data, workarounds, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/596a955d2d01b7e…ed60ebcf7c4ba518b8e5

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affects

LinuxLinuxLinux kernelLinux io_uring