CVE-2021-47561

What it actually does

Timeout handling in the virtio-i2c driver can allow the device to continue operating on I2C buffers after the guest has freed them, resulting in use-after-free and memory corruption.

Why it matters to the business

Systems using virtio-i2c may experience memory corruption, crashes, or data integrity issues on the I2C bus; the affected chromium package on Debian 11 requires an update that has been available for over two years.

How an attack unfolds

An attacker triggers a deliberate timeout during an I2C transfer so the backend device retains references to guest buffers that are subsequently freed, allowing the device to overwrite freed memory on the next operation.

How to fix it

Upgrade the chromium package on Debian 11 to version 119.0.6045.105-1~deb11u1 or later; the kernel-side fix disables timeout support in the virtio-i2c driver.

How to confirm the fix worked

Confirm the installed chromium package version is at or above 119.0.6045.105-1~deb11u1 and verify that the virtio-i2c driver no longer registers timeout handlers.

Typical attack path

1. Identify a system exposing virtio-i2c to untrusted guests or backends
2. Force a timeout condition on an I2C transfer (e.g., via debugger or slow backend)
3. Trigger a subsequent I2C transfer that reuses the freed buffers
4. Observe or exploit the resulting memory corruption

How to detect it

Review kernel logs for slub_debug poison overwrites or use-after-free reports referencing virtio_i2c_xfer; look for unexpected I2C transfer failures followed by memory corruption symptoms.

What your security team should do

• Apply the chromium update on all Debian 11 systems immediately
• Audit any workloads that rely on virtio-i2c for I2C device access
• Monitor for memory corruption indicators in virtio-i2c paths until patched