The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)

Summary: A surveillance vendor named Wintego developed an exploit for Linux socket syscall CVE-2021-0920 and used it in the wild from at least November 2020 until the issue was fixed in November 2021, combining it with Chrome and Samsung browser exploits to remotely root Samsung devices including the S10 and S20. The vulnerability is a use-after-free caused by a race condition in the SCM_RIGHTS garbage collection system, which the exploit won to obtain a UAF on a kernel sk_buff object, circumvent CONFIG_ARM64_UAO, achieve arbitrary read/write primitives, and bypass Samsung RKP to elevate to root.
What's compelling: A RedHat kernel developer found this issue in 2016 and disclosed it in a public email thread, but the Linux kernel community did not patch it until it was re-reported in 2021 - five years in which a commercial surveillance vendor could build and deploy a rooting exploit against Samsung devices.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-0920
Related: CVE-2021-0920: Android Kernel Race Condition Vulnerability Known Exploited Vulnerabilities · May 23, 2022
Racing against the clock -- hitting a tiny kernel race window Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026