CVE-2021-47358

What it actually does

Use-after-free in the greybus UART tty driver where tty state structures are released while user space holds the tty open, due to missing reference counting on the tty-port.

Why it matters to the business

Kernel memory corruption on affected Linux systems using greybus UART, potentially leading to crashes or local privilege escalation with low likelihood of exploitation in practice.

How an attack unfolds

An attacker opens a tty device backed by greybus UART, holds it open, triggers a device disconnect, and then accesses the already-freed tty state structures to corrupt kernel memory.

How to fix it

Apply the upstream fix that switches greybus UART lifetime management to the tty-port reference counter; update to a kernel containing commit resolving CVE-2021-47358.

How to confirm the fix worked

Verify the presence of the tty-port reference counter logic in drivers/staging/greybus/uart.c and confirm no direct kfree on tty state before last close.

Typical attack path

1. Obtain local access and open a greybus-backed tty device
2. Hold the tty file descriptor open indefinitely
3. Trigger greybus device disconnect or removal
4. Perform operations on the now-freed tty state to trigger UAF

How to detect it

Search kernel logs for oops, warnings, or slab-use-after-free reports referencing greybus uart or tty_port; inspect process activity opening /dev/ttyGB* devices before device removal events.

• greybus_uart
• tty_port_get
• use after free in staging/greybus/uart.c

What your security team should do

• Identify systems running greybus UART drivers and schedule kernel updates
• Monitor for kernel oops or crashes involving greybus tty structures
• Restrict untrusted local access on systems exposing greybus devices until patched