race condition between ION_IOC_ALLOC and ION_IOC_FREE could lead to UAF in [upstream-linux-4.9.y] branch

2022-04-0100:00:00

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In ion_ioctl of ion-ioctl.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
:linux_kernel:eqKernel

CPE	Name	Operator	Version
	:linux_kernel:	eq	Kernel

References

android.googlesource.com/kernel/common/+/504e1d6ee65d5

android.googlesource.com/kernel/common/+/a8200613c8c9f

android.googlesource.com/kernel/common/+/c47385c73fced

source.android.com/security/bulletin/2022-04-01