CVE-2021-47323

What it actually does

The vulnerability is a use-after-free in the sc520_wdt watchdog driver caused by calling del_timer() instead of del_timer_sync() during module removal, allowing the timer handler to execute after the module has been unloaded.

Why it matters to the business

Systems using the affected Linux kernel driver risk crashes, memory corruption, or potential code execution, which can lead to denial of service or full system compromise on servers or embedded devices relying on this watchdog.

How an attack unfolds

An attacker with local access triggers the driver's removal sequence while a timer is pending; the unsynchronized del_timer allows the handler to reference freed memory, resulting in a use-after-free that can be leveraged for kernel-level exploitation.

How to fix it

Upgrade the Linux kernel to a version containing the fix that replaces del_timer with del_timer_sync in the sc520_wdt remove path; apply the latest stable kernel updates from the distribution vendor.

How to confirm the fix worked

Inspect the sc520_wdt driver source for the presence of del_timer_sync in the remove function and verify the running kernel version includes the upstream commit resolving the timer synchronization issue.

Typical attack path

1. Obtain local code execution on a Linux system using the sc520_wdt driver
2. Trigger module unload or device removal while a watchdog timer is scheduled
3. Exploit the resulting use-after-free in the timer handler for memory corruption or privilege escalation

How to detect it

Review kernel logs and dmesg output for sc520_wdt module load/unload events, timer-related warnings, or use-after-free crashes; correlate with attempts to unload the module via modprobe or device removal.

• sc520_wdt
• wdt_turnoff
• del_timer

What your security team should do

• Apply kernel updates containing the del_timer_sync fix as the highest priority
• Audit systems for use of the sc520_wdt driver and disable the module if the hardware is not present
• Monitor kernel logs for unexpected module unloads or watchdog-related crashes