In drmsyncobjhandletofd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{ "severity": "Moderate", "fixes": [ "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4" ], "types": [ "EoP" ], "vanir_signatures": [ { "id": "PUB-A-168034487-000891dc", "digest": { "function_hash": "32970504086864143055271838817190593484", "length": 490.0 }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "signature_type": "Function", "target": { "function": "drm_syncobj_handle_to_fd", "file": "drivers/gpu/drm/drm_syncobj.c" } }, { "id": "PUB-A-168034487-4c53ecea", "digest": { "threshold": 0.9, "line_hashes": [ "283918458524159940181209964318280051069", "109175134473222033400338055823651282914", "336079167343984393011812395976112914968", "171007728591941759867591366957612582902" ] }, "signature_version": "v1", "deprecated": false, "source": "https://android.googlesource.com/kernel/common/+/328ec6286a78a71500b74255448e8f3c83d2b2c4", "signature_type": "Line", "target": { "file": "drivers/gpu/drm/drm_syncobj.c" } } ], "spl": "2021-06-05" }