Skip to content

Commit 6660962

Browse files
tniessenmarco-ippolito
authored andcommitted
deps: disable io_uring support in libuv by default
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This potentially allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). Similar concerns apply to other functions that modify the process's user identity. This commit changes libuv's io_uring behavior from opt-out (through UV_USE_IO_URING=0) to opt-in (through UV_USE_IO_URING=1) until we figure out a better long-term solution. PR-URL: nodejs-private/node-private#528 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2024-22017
1 parent 8344719 commit 6660962

File tree

2 files changed

+20
-2
lines changed

2 files changed

+20
-2
lines changed

deps/uv/src/unix/linux.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -487,8 +487,8 @@ static int uv__use_io_uring(void) {
487487
use = atomic_load_explicit(&use_io_uring, memory_order_relaxed);
488488

489489
if (use == 0) {
490-
/* Older kernels have a bug where the sqpoll thread uses 100% CPU. */
491-
use = uv__kernel_version() >= /* 5.10.186 */ 0x050ABA ? 1 : -1;
490+
/* Disable io_uring by default due to CVE-2024-22017. */
491+
use = -1;
492492

493493
/* But users can still enable it if they so desire. */
494494
val = getenv("UV_USE_IO_URING");

doc/api/cli.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2855,6 +2855,22 @@ threadpool by setting the `'UV_THREADPOOL_SIZE'` environment variable to a value
28552855
greater than `4` (its current default value). For more information, see the
28562856
[libuv threadpool documentation][].
28572857

2858+
### `UV_USE_IO_URING=value`
2859+
2860+
Enable or disable libuv's use of `io_uring` on supported platforms.
2861+
2862+
On supported platforms, `io_uring` can significantly improve the performance of
2863+
various asynchronous I/O operations.
2864+
2865+
`io_uring` is disabled by default due to security concerns. When `io_uring`
2866+
is enabled, applications must not change the user identity of the process at
2867+
runtime, neither through JavaScript functions such as [`process.setuid()`][] nor
2868+
through native addons that can invoke system functions such as [`setuid(2)`][].
2869+
2870+
This environment variable is implemented by a dependency of Node.js and may be
2871+
removed in future versions of Node.js. No stability guarantees are provided for
2872+
the behavior of this environment variable.
2873+
28582874
## Useful V8 options
28592875

28602876
V8 has its own set of CLI options. Any V8 CLI option that is provided to `node`
@@ -2959,6 +2975,8 @@ done
29592975
[`dnsPromises.lookup()`]: dns.md#dnspromiseslookuphostname-options
29602976
[`import` specifier]: esm.md#import-specifiers
29612977
[`process.setUncaughtExceptionCaptureCallback()`]: process.md#processsetuncaughtexceptioncapturecallbackfn
2978+
[`process.setuid()`]: process.md#processsetuidid
2979+
[`setuid(2)`]: https://man7.org/linux/man-pages/man2/setuid.2.html
29622980
[`tls.DEFAULT_MAX_VERSION`]: tls.md#tlsdefault_max_version
29632981
[`tls.DEFAULT_MIN_VERSION`]: tls.md#tlsdefault_min_version
29642982
[`unhandledRejection`]: process.md#event-unhandledrejection

0 commit comments

Comments
 (0)