CVE-2024-53187

io_uring: check for overflows in io_pin_pages

State: Published
Severity: 5.5 Medium
Published: Dec 27, 2024
Updated: Oct 30, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: check for overflows in io_pin_pages

WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline] io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup io_uring/io_uring.c:3781 [inline] ... </TASK>

io_pin_pages()'s uaddr parameter came directly from the user and can be garbage. Don't just add size to it as it can overflow.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	2b188cc1bb857a9d4701ae59aa7768b5124e262e to before f1938217aee05be1c1dc53f581a3c353d033b508Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 1a0aecabff72a95d240e6d7645949bfe0620dcd7Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 29eac3eca72d4c2a71122050c37cd7d8f73ac4f3Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before aaa90844afd499c9142d0199dfda74439314c013Affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 0c0a4eae26ac78379d0c1db053de168a8febc6c9Affected
LinuxLinux	5.1Affected before 5.1Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

2b188cc1bb857a9d4701ae59aa7768b5124e262e to before f1938217aee05be1c1dc53f581a3c353d033b508Affected
2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 1a0aecabff72a95d240e6d7645949bfe0620dcd7Affected
2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 29eac3eca72d4c2a71122050c37cd7d8f73ac4f3Affected
2b188cc1bb857a9d4701ae59aa7768b5124e262e to before aaa90844afd499c9142d0199dfda74439314c013Affected
2b188cc1bb857a9d4701ae59aa7768b5124e262e to before 0c0a4eae26ac78379d0c1db053de168a8febc6c9Affected

LinuxLinux

5.1Affected
before 5.1Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.