CVE-2021-47361

What it actually does

Use-after-free in mcb_alloc_bus() when ida_simple_get() fails after device_initialize() without prior get_device(), or improper put_device() usage to release resources, allowing dangling references in kernel device structures.

Why it matters to the business

Kernel instability or crashes on affected systems during bus allocation failures, with potential for local privilege escalation if the freed memory is reused maliciously; widespread impact on Linux-based devices and servers due to core kernel component.

How an attack unfolds

An attacker with local access triggers mcb_alloc_bus() error paths by inducing ida_simple_get() failure or device initialization issues, causing put_device() on uninitialized references that leads to use-after-free, enabling memory corruption for code execution.

How to fix it

Update to a Linux kernel version containing the fix for the mcb_alloc_bus() error handling (post-2024-05-21 stable releases incorporating the patch); rebuild and deploy custom kernels if using older LTS branches; test device carrier functionality post-update.

How to confirm the fix worked

Inspect kernel source for corrected put_device() and get_device() pairing in mcb_alloc_bus(); verify running kernel version against fixed upstream commits; use static analysis tools on kernel modules handling mcb devices.

Typical attack path

1. Obtain local code execution on target Linux system
2. Force mcb bus allocation via carrier device operations that invoke mcb_alloc_bus()
3. Induce ida_simple_get() failure condition during allocation
4. Trigger erroneous put_device(carrier) call without matching get_device()
5. Reuse freed device structure memory to corrupt kernel state
6. Escalate to arbitrary code execution or denial of service

How to detect it

Review kernel logs for oops/panic traces involving mcb_alloc_bus(), put_device(), or ida_simple_get() failures; examine dmesg output and audit logs for device initialization errors around carrier bus operations.

What your security team should do

• Prioritize kernel upgrades on all systems exposing mcb or carrier device interfaces
• Monitor for local privilege escalation attempts in high-risk environments
• Apply defense-in-depth with kernel hardening features like KASAN or memory tagging
• Review custom kernel configurations for mcb bus usage