CVE-2021-47505 is a use-after-free vulnerability in the Linux kernel related to the asynchronous I/O (aio) polling mechanism. Specifically, the issue arises from improper handling of the POLLFREE notification in aio poll operations. In Linux, signalfd_poll() and binder_poll() use a waitqueue tied to the current task's lifetime rather than the struct file, which is atypical. For blocking polls, this design is safe because the poll occurs within a single task context. However, non-blocking polls require the waitqueue to be cleared before it is freed by sending a POLLFREE notification to all waiters to avoid use-after-free conditions. While the eventpoll mechanism correctly handles POLLFREE, aio poll, introduced in kernel version 4.18, did not implement this handling, leading to a use-after-free vulnerability when signalfd or binder file descriptors are polled with aio poll and the waitqueue is freed prematurely. Attempts to fix this by completing requests inline upon POLLFREE detection introduced deadlocks and missed notifications due to locking order inversion and temporary dequeuing of requests. The final fix involves handling POLLFREE in aio poll in a deadlock-free manner by leveraging RCU-delayed freeing of waitqueues, similar to eventpoll's approach. This patch prevents the use-after-free condition by ensuring proper synchronization and notification handling during aio poll operations.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions, especially servers and infrastructure components relying on asynchronous I/O operations with signalfd or binder file descriptors. Exploitation could lead to kernel memory corruption, potentially allowing local attackers to execute arbitrary code with kernel privileges, cause system crashes, or escalate privileges. This can compromise confidentiality, integrity, and availability of critical systems. Given Linux's widespread use in European data centers, cloud infrastructure, and embedded systems, exploitation could disrupt services, lead to data breaches, or facilitate lateral movement within networks. Although no known exploits are reported in the wild, the complexity of the vulnerability means that skilled attackers could develop exploits, particularly targeting high-value assets such as financial institutions, government infrastructure, and telecommunications providers in Europe.

European organizations should prioritize updating Linux kernels to versions that include the fix for CVE-2021-47505. Since the vulnerability involves kernel-level asynchronous I/O polling, patching the kernel is the most effective mitigation. Organizations should: 1) Identify all systems running affected Linux kernel versions, especially those using aio poll with signalfd or binder file descriptors. 2) Apply vendor-provided kernel updates or backported patches promptly. 3) For systems where immediate patching is not feasible, restrict access to local user accounts to trusted personnel only, as exploitation requires local access. 4) Monitor kernel logs and system behavior for anomalies indicative of use-after-free exploitation attempts, such as unexpected crashes or suspicious aio poll activity. 5) Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and Kernel Page Table Isolation (KPTI) to reduce exploitation likelihood. 6) Review and limit the use of signalfd and binder interfaces where possible to reduce attack surface. 7) Incorporate this vulnerability into vulnerability management and incident response plans to ensure rapid detection and remediation.