CVE-2021-47280

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix use-after-free read in drm_getunique()

There is a time-of-check-to-time-of-use error in drm_getunique() due

to retrieving file_priv->master prior to locking the device's master

mutex.

An example can be seen in the crash report of the use-after-free error

found by Syzbot:

https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803

In the report, the master pointer was used after being freed. This is

because another process had acquired the device's master mutex in

drm_setmaster_ioctl(), then overwrote fpriv->master in

drm_new_set_master(). The old value of fpriv->master was subsequently

freed before the mutex was unlocked.

To fix this, we lock the device's master mutex before retrieving the

pointer from from fpriv->master. This patch passes the Syzbot

reproducer test.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References