CVE-2021-20226: 
Linux Debian vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2021-20226) was discovered in the io_uring feature of the Linux kernel. The vulnerability was reported by Ryota Shiga of Flatt Security Team and was first disclosed on February 23, 2021. The flaw affects Linux kernel versions from 5.5 up to versions prior to 5.10.2 (ZDI Advisory, NVD).

The vulnerability stems from the lack of validation of object existence prior to performing operations on the object in the io_uring subsystem. Specifically, the issue occurs due to not incrementing the file reference counter while in use within the io_grab_files function in fs/io_uring.c. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow a local attacker with user privileges to cause a denial of service condition, disclose sensitive information, or modify data. The highest threats from this vulnerability are to data integrity, confidentiality, and system availability. An attacker can potentially leverage this vulnerability to escalate privileges and execute code in the context of the kernel (ZDI Advisory, Red Hat Bugzilla).

The vulnerability requires local access and low privileges to exploit. An attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability was reported to the vendor on December 23, 2020, and was publicly disclosed on January 4, 2021 (ZDI Advisory).

The vulnerability was fixed in Linux kernel version 5.10.2. The fix involved removing the affected code as part of a cleanup in commit 233295130e53. For systems that cannot be immediately updated, no specific workarounds are available that meet security criteria for ease of use and deployment (Red Hat Bugzilla).