7

CVE-2021-47280

drm: Fix use-after-free read in drm_getunique()

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix use-after-free read in drm_getunique()

There is a time-of-check-to-time-of-use error in drm_getunique() due
to retrieving file_priv->master prior to locking the device's master
mutex.

An example can be seen in the crash report of the use-after-free error
found by Syzbot:
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803

In the report, the master pointer was used after being freed. This is
because another process had acquired the device's master mutex in
drm_setmaster_ioctl(), then overwrote fpriv->master in
drm_new_set_master(). The old value of fpriv->master was subsequently
freed before the mutex was unlocked.

To fix this, we lock the device's master mutex before retrieving the
pointer from from fpriv->master. This patch passes the Syzbot
reproducer test.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
LinuxLinux Kernel Version < 4.14.237
LinuxLinux Kernel Version >= 4.15 < 4.19.195
LinuxLinux Kernel Version >= 4.20 < 5.4.126
LinuxLinux Kernel Version >= 5.5 < 5.10.44
LinuxLinux Kernel Version >= 5.11 < 5.12.11
LinuxLinux Kernel Version5.13 Updaterc1
LinuxLinux Kernel Version5.13 Updaterc2
LinuxLinux Kernel Version5.13 Updaterc3
LinuxLinux Kernel Version5.13 Updaterc4
LinuxLinux Kernel Version5.13 Updaterc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.079
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/17dab9326ff263c62dab1dbac4492e2938a049e4
Patch
https://git.kernel.org/stable/c/491d52e0078860b33b6c14f0a7ac74ca1b603bd6
Patch
https://git.kernel.org/stable/c/7d233ba700ceb593905ea82b42dadb4ec8ef85e9
Patch
https://git.kernel.org/stable/c/b246b4c70c1250e7814f409b243000f9c0bf79a3
Patch
https://git.kernel.org/stable/c/b436acd1cf7fac0ba987abd22955d98025c80c2b
Patch
https://git.kernel.org/stable/c/f773f8cccac13c7e7bbd9182e7996c727742488e
Patch