CVE-2021-47200 (GCVE-0-2021-47200)
Vulnerability from cvelistv5
Published
2024-04-10 18:56
Modified
2025-05-04 07:06
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper. This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."
References
Impacted products
Vendor Product Version
Linux Linux Version: 9786b65bc61acec63f923978c75e707afbb74bc7
Version: 9786b65bc61acec63f923978c75e707afbb74bc7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47200",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-15T14:57:54.210831Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T17:48:37.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.374Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_prime.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f8e469a2384dfa4047145b0093126462cbb6dc0",
              "status": "affected",
              "version": "9786b65bc61acec63f923978c75e707afbb74bc7",
              "versionType": "git"
            },
            {
              "lessThan": "8244a3bc27b3efd057da154b8d7e414670d5044f",
              "status": "affected",
              "version": "9786b65bc61acec63f923978c75e707afbb74bc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_prime.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.5",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\n\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\nthe gem object\u0027s refcount == 1 on entry to drm_gem_prime_mmap(), that\ndrop will free the gem object, and the subsequent drm_gem_object_get()\nwill be a UAF. Fix by grabbing a reference before calling the mmap\nhelper.\n\nThis issue was forseen when the reference dropping was adding in\ncommit 9786b65bc61ac (\"drm/ttm: fix mmap refcounting\"):\n  \"For that to work properly the drm_gem_object_get() call in\n  drm_gem_ttm_mmap() must be moved so it happens before calling\n  obj-\u003efuncs-\u003emmap(), otherwise the gem refcount would go down\n  to zero.\""
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:06:15.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f"
        }
      ],
      "title": "drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47200",
    "datePublished": "2024-04-10T18:56:35.152Z",
    "dateReserved": "2024-03-25T09:12:14.117Z",
    "dateUpdated": "2025-05-04T07:06:15.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47200\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-10T19:15:48.077\",\"lastModified\":\"2025-01-07T17:12:06.773\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\\n\\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\\nthe gem object\u0027s refcount == 1 on entry to drm_gem_prime_mmap(), that\\ndrop will free the gem object, and the subsequent drm_gem_object_get()\\nwill be a UAF. Fix by grabbing a reference before calling the mmap\\nhelper.\\n\\nThis issue was forseen when the reference dropping was adding in\\ncommit 9786b65bc61ac (\\\"drm/ttm: fix mmap refcounting\\\"):\\n  \\\"For that to work properly the drm_gem_object_get() call in\\n  drm_gem_ttm_mmap() must be moved so it happens before calling\\n  obj-\u003efuncs-\u003emmap(), otherwise the gem refcount would go down\\n  to zero.\\\"\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/prime: Arreglar el use-after-free en mmap con drm_gem_ttm_mmap drm_gem_ttm_mmap() elimina una referencia al objeto gema en caso de \u00e9xito. Si el refcount del objeto gema == 1 en la entrada a drm_gem_prime_mmap(), esa eliminaci\u00f3n liberar\u00e1 el objeto gema y el drm_gem_object_get() posterior ser\u00e1 un UAF. Se soluciona tomando una referencia antes de llamar al ayudante mmap. Este problema se previ\u00f3 cuando se agreg\u00f3 la eliminaci\u00f3n de referencia en el commit 9786b65bc61ac (\\\"drm/ttm: corregir el recuento de referencias mmap\\\"): \\\"Para que eso funcione correctamente, la llamada drm_gem_object_get() en drm_gem_ttm_mmap() debe moverse para que suceda antes de llamar a obj-\u0026gt;funcs-\u0026gt;mmap(), de lo contrario, el recuento de referencias de la gema bajar\u00eda a cero\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.15.5\",\"matchCriteriaId\":\"24C2E67E-369B-4DC4-89C9-101DE1BAA919\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.374Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47200\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-15T14:57:54.210831Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-03T17:48:33.921Z\"}}], \"cna\": {\"title\": \"drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9786b65bc61acec63f923978c75e707afbb74bc7\", \"lessThan\": \"4f8e469a2384dfa4047145b0093126462cbb6dc0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9786b65bc61acec63f923978c75e707afbb74bc7\", \"lessThan\": \"8244a3bc27b3efd057da154b8d7e414670d5044f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/drm_prime.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/drm_prime.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0\"}, {\"url\": \"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\\n\\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\\nthe gem object\u0027s refcount == 1 on entry to drm_gem_prime_mmap(), that\\ndrop will free the gem object, and the subsequent drm_gem_object_get()\\nwill be a UAF. Fix by grabbing a reference before calling the mmap\\nhelper.\\n\\nThis issue was forseen when the reference dropping was adding in\\ncommit 9786b65bc61ac (\\\"drm/ttm: fix mmap refcounting\\\"):\\n  \\\"For that to work properly the drm_gem_object_get() call in\\n  drm_gem_ttm_mmap() must be moved so it happens before calling\\n  obj-\u003efuncs-\u003emmap(), otherwise the gem refcount would go down\\n  to zero.\\\"\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.5\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:06:15.756Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47200\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:06:15.756Z\", \"dateReserved\": \"2024-03-25T09:12:14.117Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-10T18:56:35.152Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.