CVE-2021-39801: Use After Free Vulnerability in Linux Kernel
Summary
CVE-2021-39801: In ion_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. Affects :linux_kernel: versions >= :0, < :2022-04-05. Fixed in :2022-04-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, such as memory, processes, and device drivers. The vulnerability identified as CVE-2021-39801 affects the Linux Kernel in the [upstream-linux-4.9.y] branch. This vulnerability arises due to a race condition between the ION_IOC_ALLOC and ION_IOC_FREE functions in the ion-ioctl.c file. Improper locking during these operations can result in a use after free scenario, potentially leading to local privilege escalation. Exploitation of this vulnerability does not require any additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability in the Linux Kernel arises from a race condition between the ION_IOC_ALLOC and ION_IOC_FREE functions in the ion-ioctl.c file. This race condition occurs due to improper locking, which can result in a use after free scenario. An attacker could exploit this vulnerability to escalate their privileges locally without requiring any additional execution privileges or user interaction. The use after free scenario can lead to arbitrary code execution or other malicious activities, potentially compromising the security and integrity of the affected system.
How To Fix
Minimum fixed version
:2022-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The use after free vulnerability in the Linux Kernel, identified as CVE-2021-39801, poses a significant risk of local privilege escalation. It is crucial to update the Linux Kernel to a version that includes the necessary fixes to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
This vulnerability can lead to local privilege escalation, allowing an attacker to gain elevated privileges on the affected system.
No, user interaction is not required for exploitation of this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
The vulnerability affects the [upstream-linux-4.9.y] branch of the Linux Kernel.
Yes, the Linux Kernel community has released fixes for this vulnerability in the [upstream-linux-4.9.y] branch.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
