CVE-2021-47280 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free read in drm_getunique()
There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex.
An example can be seen in the crash report of the use-after-free error found by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked.
To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/24/2024
The vulnerability CVE-2021-47280 represents a critical use-after-free condition within the Linux kernel's Direct Rendering Manager subsystem, specifically affecting the drm_getunique() function. This flaw manifests as a time-of-check-to-time-of-use error that creates a race condition between process threads accessing shared kernel memory structures. The vulnerability occurs when the system retrieves the file_priv->master pointer before acquiring the device's master mutex, creating a window where another process can modify or free the pointer while the first process is still using it. Such race conditions are particularly dangerous in kernel space as they can lead to arbitrary code execution or system crashes. The issue was identified through automated fuzzing by Syzbot, which demonstrated the exact scenario where a freed master pointer was accessed after being overwritten by concurrent operations.
The technical implementation of this vulnerability involves the drm_setmaster_ioctl() function which acquires the device's master mutex and subsequently calls drm_new_set_master() to overwrite the fpriv->master pointer. During this process, the original master pointer value gets freed but the drm_getunique() function has already retrieved this pointer value without first acquiring the mutex protection. This creates a scenario where the freed memory location may be accessed by the first process, leading to undefined behavior and potential security exploits. The vulnerability is classified under CWE-416 as Use After Free, which specifically addresses situations where memory is accessed after it has been freed, and represents a classic race condition pattern. The flaw directly impacts the kernel's memory management and synchronization mechanisms, particularly the mutex locking protocols that should prevent concurrent access to shared resources.
The operational impact of CVE-2021-47280 extends beyond simple system instability to potentially enable privilege escalation and arbitrary code execution within the kernel space. When exploited, this vulnerability allows attackers to manipulate the drm_getunique() function to access freed memory locations, which could be leveraged to execute malicious code with kernel privileges. The attack surface is particularly concerning for systems utilizing graphics rendering capabilities, as the Direct Rendering Manager subsystem is integral to graphics processing in Linux environments. This vulnerability affects systems running Linux kernel versions prior to the patched release and represents a significant security risk for servers, desktops, and embedded systems that utilize graphics hardware. The flaw's exploitation potential aligns with ATT&CK technique T1068 which covers locally executed malicious code, and T1543 which involves privilege escalation through kernel exploits. The vulnerability demonstrates how seemingly minor synchronization issues in kernel code can create substantial security implications.
The fix for CVE-2021-47280 implements a straightforward but crucial synchronization improvement that addresses the root cause of the race condition. The patch modifies the drm_getunique() function to acquire the device's master mutex before retrieving the fpriv->master pointer, ensuring that concurrent access is properly serialized. This change prevents the scenario where one process can free a pointer while another process is still using it, effectively closing the time-of-check-to-time-of-use window. The solution follows established kernel programming practices for mutex usage and memory synchronization, ensuring that all shared resource access is properly protected. The fix has been validated through the Syzbot reproducer test, confirming that the patched version resolves the use-after-free condition while maintaining normal system functionality. This mitigation approach represents a standard defensive programming technique that aligns with security best practices for kernel development and demonstrates the importance of proper synchronization mechanisms in preventing race conditions.