Racing against the clock -- hitting a tiny kernel race window
Summary: Google Project Zero researchers found a race condition in the Linux kernel's UNIX domain socket garbage collection code, where the GC assumes exclusive access to a file by comparing its refcount against inflight socket buffer references, but an RCU reference can be upgraded to a refcounted one via get_file_rcu() in __fget_files(). They hit the roughly 12-instruction race window on a normal Linux desktop kernel at a hit rate around 30% when the proof of concept was tuned for the specific machine, stopping at evidence of use-after-free accesses rather than a full exploit.
What's compelling: The writeup demonstrates that even very small race windows can be exploitable if someone sinks enough time into it, so dismissing them as unexploitable or not treating them as security bugs is a mistake - and the fix required adding a check to the hot __fget_files() path.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-0920
- Related
- CVE-2021-0920: Android Kernel Race Condition Vulnerability Known Exploited Vulnerabilities · May 23, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026