CVE-2021-47200

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47200

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper. This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."

References
Link Resource
https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 Patch
https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f Patch
https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 Patch
https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Jan 2025, 17:12

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 - () https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 - Patch
References () https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f - () https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f - Patch
First Time Linux linux Kernel
Linux
CWE CWE-416

21 Nov 2024, 06:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 - () https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 -
References () https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f - () https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/prime: Arreglar el use-after-free en mmap con drm_gem_ttm_mmap drm_gem_ttm_mmap() elimina una referencia al objeto gema en caso de éxito. Si el refcount del objeto gema == 1 en la entrada a drm_gem_prime_mmap(), esa eliminación liberará el objeto gema y el drm_gem_object_get() posterior será un UAF. Se soluciona tomando una referencia antes de llamar al ayudante mmap. Este problema se previó cuando se agregó la eliminación de referencia en el commit 9786b65bc61ac ("drm/ttm: corregir el recuento de referencias mmap"): "Para que eso funcione correctamente, la llamada drm_gem_object_get() en drm_gem_ttm_mmap() debe moverse para que suceda antes de llamar a obj->funcs->mmap(), de lo contrario, el recuento de referencias de la gema bajaría a cero".
Information

Published : 2024-04-10 19:15

Updated : 2025-01-07 17:12

NVD link : CVE-2021-47200

Mitre link : CVE-2021-47200

CVE.ORG link : CVE-2021-47200

JSON object : View

Products Affected

linux

CWE
CWE-416

Use After Free