Learnings from kCTF VRP's 42 Linux kernel exploits submissions
<p><pre><code>  &gt; While io_uring brings performance benefits, and promptly reacts to security
  &gt; issues with comprehensive security fixes (like backporting the 5.15 version
  &gt; to the 5.10 stable tree), it is a fairly new part of the kernel. As such,
  &gt; io_uring continues to be actively developed, but it is still affected by
  &gt; severe vulnerabilities and also provides strong exploitation primitives. For
  &gt; these reasons, we currently consider it safe only for use by trusted
  &gt; components.
</code></pre>
As often in the kernel (and probably everywhere): there are people caring for performance and there are people caring for security, and a lot of the time there&#x27;s not that much overlap.<p>Ensuring that io_uring is covered by the Linux Security Modules (LSM) framework, that provides hooks for things like AppArmor or SELinux (and a variety of others, some even can even get stacked), was only done after it was already quite popular.<p>So FWICT, even if io_uring is existing since a while, 1) the security experts vetting it are looking only closer since relatively recently and 2) it&#x27;s architecture is quite different from other kernel user space interfaces, which certainly needs some adaptions on applying the established security mechanisms of the kernel, especially as the project still wants to stay high performance.<p>IMO, this doesn&#x27;t mean io_uring is inherently unsafe, or has no use, but that one certainly needs to evaluate if great async submission model is worth the potential security implications. E.g., in an isolate environment, where no untrusted third-party apps or people have access, it can be fine, while especially in environments that Google runs it isn&#x27;t worth the trouble for now.<p>But, I think that the features which io_uring brings are too nice to have for quite some (I&#x2F;O or syscall heavy) workloads even in those environments, so there will be an incentive it to the integration into the existing Linux security stack and mechanisms, and evolve the latter to be also a good fit for this rather different interface.