libuv io_uring

The libuv io_uring tag covers discussions about CVE-2024-22017, a privilege-escalation vulnerability in libuv's io_uring subsystem. This flaw occurs when libuv's io_uring machinery is initialized before a process calls setuid(), allowing the process to retain privileged operations through libuv internals even after attempting to drop privileges. The vulnerability affects Azure Linux and potentially other Microsoft products. Topics include the technical details of the flaw, its impact on privilege separation, and Microsoft's product-scoped attestation regarding affected artifacts.