CVE-2021-47653
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: media: davinci: vpif: fix use-after-free on driver unbind The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind. This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors. Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names.
Security Summary
CVE-2021-47653 is a use-after-free vulnerability in the Linux kernel's media subsystem, specifically the DaVinci VPIF (Video Processing Interface) driver. During the driver's probe function, two platform device structures are allocated using devres and registered, but these devices are not deregistered in the driver's remove callback. As a result, when the driver core frees the structures after remove returns, it triggers a use-after-free condition. The issue is classified under CWE-416 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability by triggering the driver unbind operation, such as through device removal or module unloading. Successful exploitation could allow the attacker to achieve high confidentiality, integrity, and availability impacts, potentially leading to arbitrary code execution, data corruption, or system crashes within the kernel context.
The provided kernel stable commit references detail the mitigation, which involves adding the missing deregistration calls for the platform devices in the driver's remove callback, failing the probe function on registration errors, and ensuring the devices are freed using a proper release callback to prevent resource leaks like device names. Security practitioners should apply these patches from the referenced stable kernel commits to affected versions.
Details
- CWE(s)