CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's io_uring subsystem, specifically in the handling of user-supplied sizes during the `copy_struct_to_user()` operation. An attacker can exploit this flaw to request nearly 4 GiB of memory zeroing, potentially leading to denial-of-service conditions or memory corruption. Organizations using Linux kernel versions that include this vulnerability should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces.