In drmsyncobjhandletofd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{ "spl": "2021-06-05", "severity": "Moderate", "fixes": [ "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4" ], "vanir_signatures": [ { "signature_version": "v1", "target": { "function": "drm_syncobj_handle_to_fd", "file": "drivers/gpu/drm/drm_syncobj.c" }, "digest": { "length": 490.0, "function_hash": "32970504086864143055271838817190593484" }, "signature_type": "Function", "source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "deprecated": false, "id": "PUB-A-168034487-000891dc" }, { "signature_version": "v1", "target": { "file": "drivers/gpu/drm/drm_syncobj.c" }, "digest": { "line_hashes": [ "283918458524159940181209964318280051069", "109175134473222033400338055823651282914", "336079167343984393011812395976112914968", "171007728591941759867591366957612582902" ], "threshold": 0.9 }, "signature_type": "Line", "source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "deprecated": false, "id": "PUB-A-168034487-4c53ecea" } ], "types": [ "EoP" ] }