CVE-2021-47048

What it actually does

Use-after-free in the ZynqMP GQSPI driver when op->addr references a freed tmpbuf buffer during exec_op handling, allowing kernel memory corruption via stale pointer access.

Why it matters to the business

Potential kernel crashes, system instability, or local privilege escalation on Linux systems using the affected SPI controller; low exploitation likelihood reduces immediate operational risk.

How an attack unfolds

A local attacker triggers SPI operations that allocate and free tmpbuf, then causes the driver to dereference the stale address value or opcode, leading to memory corruption that can be chained for escalation.

How to fix it

Upgrade to a Linux kernel release that applies the fix replacing tmpbuf usage with temporary variables for storing address value and command opcode.

How to confirm the fix worked

Confirm the patched driver code uses stack temporaries for op->addr.val and op->cmd.opcode; test SPI workloads and verify absence of KASAN use-after-free reports for this function.

Typical attack path

1. Gain local user access on an affected Linux system
2. Invoke SPI transactions that exercise zynqmp_qspi_exec_op
3. Manipulate operation parameters to trigger access to the freed buffer
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs and dmesg for KASAN use-after-free warnings referencing zynqmp_qspi_exec_op or tmpbuf; review crash dumps for references to the affected SPI driver.

What your security team should do

• Prioritize kernel updates on systems exposing the ZynqMP QSPI driver
• Limit untrusted local access until patched
• Enable KASAN or similar memory debugging in test environments to validate the fix