CVE-2021-47505: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47505 is a use-after-free vulnerability in the Linux kernel's asynchronous I/O (AIO) subsystem, specifically related to missing POLLFREE handling in signalfd_poll() and binder_poll() functions. The vulnerability affects Linux kernel versions from 4.18 up to versions before 4.19.221, 5.4.165, 5.10.85, 5.15.8, and 5.16-rc4 (Kernel Git).

The vulnerability occurs because signalfd_poll() and binder_poll() use a waitqueue whose lifetime is tied to the current task rather than the struct file. While this works for blocking polls within one task, it creates issues with non-blocking polls. The proper solution requires clearing the queue before freeing it by sending a POLLFREE notification to all waiters. However, only eventpoll handled POLLFREE, while aio poll (added in kernel v4.18) did not, leading to a potential use-after-free condition when a signalfd or binder fd is polled with aio poll and the waitqueue gets freed (Kernel Git). The vulnerability has been assigned a CVSS v3.1 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow an attacker with local access to cause a use-after-free condition, potentially leading to privilege escalation, information disclosure, or system crashes. The high CVSS scores for confidentiality, integrity, and availability (C:H/I:H/A:H) indicate severe potential impacts across all three security aspects (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), and no user interaction (UI:N) is needed. The scope is unchanged (S:U), meaning the impact is limited to the vulnerable component (NVD).

The vulnerability has been fixed by making aio poll handle POLLFREE in a deadlock-free way, taking advantage of RCU-delayed freeing of the waitqueue. The fix was implemented through a patch that properly handles POLLFREE notifications and prevents the use-after-free condition (Kernel Git).