CVE-2021-47500

What it actually does

The vulnerability is a use-after-free in the Linux kernel IIO subsystem where the mma8452 driver assigns a trigger to struct iio_dev without first calling iio_trigger_get(), allowing the IIO core's subsequent iio_trigger_put() to drop the reference count to zero and free the trigger while it remains in use.

Why it matters to the business

Systems using the affected accelerometer hardware may experience kernel crashes, instability, or potential local privilege escalation, leading to unplanned downtime or security breaches on Linux-based devices and embedded platforms.

How an attack unfolds

An attacker with local access loads the mma8452 driver, interacts with the IIO device to assign a trigger, forces the core to release its reference causing premature free, then reuses the dangling pointer to corrupt kernel memory or execute code.

How to fix it

Apply a Linux kernel update containing the upstream fix that adds iio_trigger_get() before assigning the trigger to the IIO device; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the mma8452 driver source for the added iio_trigger_get() call prior to assignment, or exercise the IIO trigger path on affected hardware and confirm no use-after-free warnings appear in kernel logs.

Typical attack path

1. Load mma8452 IIO driver on a system with compatible hardware
2. Open and configure the IIO device to assign a trigger
3. Trigger the IIO core to call iio_trigger_put() without a prior get
4. Reuse the now-freed trigger object via dangling pointer
5. Achieve kernel memory corruption or code execution

How to detect it

Search kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings, oops, or panic messages referencing iio_trigger or mma8452; correlate with processes accessing IIO character devices.

What your security team should do

• Prioritize kernel upgrades on all systems exposing IIO devices
• Restrict unprivileged local access where sensor drivers are present
• Enable kernel hardening features such as KASAN or SLUB_DEBUG for early detection
• Monitor kernel logs for IIO-related oops or use-after-free reports