CVE-2021-47533: drm/vc4: kms: Clear the HVS FIFO commit pointer once done
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO.
However, we never cleared that pointer once done. Since drmcrtccommitput can free the drmcrtccommit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state.
Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel DRM vc4 KMSto a version that resolves this vulnerability.Patch 9ec03d7f1ed3
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47533?
CVE-2021-47533 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2021-47533?
To fix CVE-2021-47533, update your Linux kernel to the latest version that addresses this vulnerability.
What versions of the Linux kernel are affected by CVE-2021-47533?
CVE-2021-47533 affects Linux kernel versions from 5.12 to 5.15.7, as well as 5.16-rc1 through 5.16-rc3.
What is the nature of the vulnerability in CVE-2021-47533?
CVE-2021-47533 involves a flaw in the drm/vc4 subsystem related to FIFO commit pointer handling.
Is CVE-2021-47533 exploitable remotely?
CVE-2021-47533 is not typically considered a remote exploit but may affect systems where the vulnerable component is accessible.