In drmsyncobjhandletofd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 490.0, "function_hash": "32970504086864143055271838817190593484" }, "id": "PUB-A-168034487-000891dc", "source": "http://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/drm_syncobj.c", "function": "drm_syncobj_handle_to_fd" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "283918458524159940181209964318280051069", "109175134473222033400338055823651282914", "336079167343984393011812395976112914968", "171007728591941759867591366957612582902" ] }, "id": "PUB-A-168034487-4c53ecea", "source": "http://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/drm_syncobj.c" }, "signature_type": "Line" } ], "fixes": [ "http://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4" ], "spl": "2021-06-05", "severity": "Moderate", "types": [ "EoP" ] }