Executive Summary

This vulnerability is a use-after-free race condition in the Linux kernel's fastrpc component, specifically in the fastrpc_map_create function.

The issue occurs because fastrpc_map_lookup returns a raw pointer after releasing a lock (fl->lock). Then, the caller function fastrpc_map_create calls fastrpc_map_get on this pointer without protection.

Meanwhile, a concurrent MEM_UNMAP operation can free the memory map between the lock release and the reference count operation, causing a use-after-free on the freed slab object.

The fix involves restoring the take_ref parameter to fastrpc_map_lookup so that the reference is acquired atomically while holding the lock, preventing the pointer from being freed concurrently.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a use-after-free condition, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges within the kernel.

Because it involves kernel memory management, exploitation could compromise the security and reliability of the affected system.

Useful 0 Not Useful 0