Vulnerability identifier: #VU61996

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-0707

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in dma_buf. A local user can trigger a race between closing the dmabuf file and reading the dmabuf's debug info and execute arbitrary code with elevated privileges.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

CPE

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links
http://source.android.com/security/bulletin/2022-04-01#details-05
http://android.googlesource.com/kernel/common/+/6e6c15288df8c4c6264f394ece251ef9f64b0e3f

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?