# CVE-2021-0920: Android sk_buff use-after-free in Linux

Race in Linux Unix-socket GC with recvmsg MSG_PEEK causes sk_buff use-after-free, exploited in Samsung chain to leak file pointers and gain arbitrary read/write.

- Payout: Real-world hack
- Severity: high
- Program: Google Android
- Credited: Xingyu Jin, Android Security Research
- Disclosed: 2021-11-05
- CVE: CVE-2021-0920
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-0920.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-0920
- Tags: domain:mobile domain:oss impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:linux technique:chained technique:race-window vuln:memory-corruption vuln:race-condition

**Target:** Linux kernel Unix-domain socket garbage collector (sk_buff)
**Root cause:** GC can treat an inflight socket as garbage while recvmsg with MSG_PEEK increments the file refcount, corrupting GC state and freeing an sk_buff still in use.
**Steps:**
1. Create Unix socketpair `sv`; send a socket fd via `SCM_RIGHTS` to set up inflight state.
2. Spawn GC thread pinned to CPU3 that closes sockets to trigger `unix_gc()`.
3. Spawn recvmsg thread pinned to CPU2 calling `recvmsg(sv[1], &msg, 0x80042)` (MSG_PEEK|MSG_CMSG_CLOEXEC) racing GC.
4. Create many garbage socketpairs/fds to prolong GC and widen race window.
5. Win race: recvmsg returns a UAF `sk_buff` whose `data` overlaps a `scm_fp_list`, leaking file pointers.
6. Free leaked fds and spray slab pages to control page content; place fake pipe structures and link via `skb_unlink`.
7. Abuse `pipe_buffer->page`/`offset` for arbitrary read/write.
**How found:** Originally found in 2016 by a developer heavily using SCM_RIGHTS + MSG_PEEK; patch not accepted. Project Zero analyzed in-the-wild exploit sample and identified the GC/refcount race.
**Exploitation:** Exploit orchestrates two threads racing recvmsg against GC while additional threads spray heap and pin CPUs. Winning thread receives UAF sk_buff overlapping scm_fp_list, leaking file struct pointers. Attacker frees those fds, sprays controlled slab pages, plants fake pipe structures, links them via skb_unlink, then uses pipe_buffer fields for arbitrary read/write. Used as kernel privilege-escalation stage in Samsung full chain with CVE-2021-38000 and CVE-2020-16040.
**Escalation:** Chained with Samsung browser 0day CVE-2021-38000 and Chrome n-day CVE-2020-16040 for full RCE chain; UAF primitive escalated to arbitrary read/write via pipe_buffer corruption.
**Insight:** Unix socket GC state can be corrupted by refcount changes from MSG_PEEK recvmsg racing GC; look for refcount/GC interactions on inflight file descriptors, and use scm_fp_list overlap to leak file pointers then pivot to pipe_buffer for arbitrary R/W.