CVE-2021-47357

What it actually does

In the Linux kernel ATM iphase driver, ia_module_exit calls del_timer which returns immediately without waiting for any pending timer handler to finish, allowing the handler to execute after the module memory has been freed and resulting in a use-after-free.

Why it matters to the business

Local users or compromised processes could trigger kernel instability, crashes, or potential code execution on systems using the iphase ATM driver, increasing downtime and risk of privilege escalation.

How an attack unfolds

An attacker with local access unloads or triggers removal of the iphase module while a timer remains active; the handler then runs after module exit has freed associated structures, dereferencing invalid memory.

How to fix it

Apply a kernel update that replaces del_timer with del_timer_sync inside ia_module_exit for the iphase driver; rebuild and reboot onto the patched kernel image.

How to confirm the fix worked

Inspect the iphase driver source for del_timer_sync in the module exit path; confirm the running kernel contains the fix commit and test module load/unload cycles without crashes.

Typical attack path

1. Obtain local access on a system with the iphase ATM driver loaded
2. Trigger module removal or rmmod while a timer callback is scheduled
3. Race the del_timer call so the handler executes post-free
4. Leverage the resulting use-after-free for kernel memory corruption or DoS

How to detect it

Search kernel logs, dmesg, and crash dumps for stack traces referencing ia_module_exit, iphase, del_timer, or use-after-free during module unload operations.

• ia_module_exit
• use-after-free.*iphase
• del_timer.*atm

What your security team should do

• Prioritize kernel upgrades on any systems exposing ATM or iphase drivers
• Restrict unprivileged module loading via kernel module signing and CAP_SYS_MODULE controls
• Monitor kernel logs for oops or use-after-free reports involving ia_module_exit