In drmsyncobjhandletofd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4"
],
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4",
"deprecated": false,
"digest": {
"length": 490.0,
"function_hash": "32970504086864143055271838817190593484"
},
"signature_type": "Function",
"id": "PUB-A-168034487-000891dc",
"target": {
"function": "drm_syncobj_handle_to_fd",
"file": "drivers/gpu/drm/drm_syncobj.c"
}
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4",
"deprecated": false,
"digest": {
"line_hashes": [
"283918458524159940181209964318280051069",
"109175134473222033400338055823651282914",
"336079167343984393011812395976112914968",
"171007728591941759867591366957612582902"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "PUB-A-168034487-4c53ecea",
"target": {
"file": "drivers/gpu/drm/drm_syncobj.c"
}
}
],
"types": [
"EoP"
],
"severity": "Moderate",
"spl": "2021-06-05"
}