{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-47533", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-24T15:02:54.826Z", "datePublished": "2024-05-24T15:09:42.683Z", "dateUpdated": "2026-08-05T08:48:15.580Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:48:15.580Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: kms: Clear the HVS FIFO commit pointer once done\n\nCommit 9ec03d7f1ed3 (\"drm/vc4: kms: Wait on previous FIFO users before a\ncommit\") introduced a wait on the previous commit done on a given HVS\nFIFO.\n\nHowever, we never cleared that pointer once done. Since\ndrm_crtc_commit_put can free the drm_crtc_commit structure directly if\nwe were the last user, this means that it can lead to a use-after free\nif we were to duplicate the state, and that stale pointer would even be\ncopied to the new state.\n\nSet the pointer to NULL once we're done with the wait so that we don't\ncarry over a pointer to a free'd structure." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through DRM atomic modeset ioctls (DRM_IOCTL_MODE_ATOMIC → vc4_atomic_commit_setup/tail) on the local VC4 DRM device (/dev/dri/cardN), not via network packet processing.\nAC:L - An attacker who can issue atomic commits fully controls the commit sequence that drops the last drm_crtc_commit reference and then duplicates HVS state, so the stale-pointer UAF is reliably triggerable without depending on external conditions.\nPR:L - Atomic commits require DRM master, but mastership is obtainable without CAP_SYS_ADMIN by the first opener of the primary node, a logind session user, or a DRM lease client—common for unprivileged video-group users on Raspberry Pi/embedded systems.\nUI:N - The attacker triggers the vulnerability directly by issuing their own atomic commit ioctls; no separate victim action is required.\nS:U - Successful exploitation affects the local kernel/host authority only (privilege escalation or crash within the same OS instance), with no VM/IOMMU/sandbox boundary crossed.\nC:H - This is a use-after-free of drm_crtc_commit that is re-referenced via drm_crtc_commit_get on state duplication, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - UAF of a kmalloc'd drm_crtc_commit object enables heap reuse and control-flow hijacking primitives, supporting arbitrary kernel write / code execution.\nA:H - Use of the freed commit pointer (wait/get/put paths) can cause kernel oops, hang, or panic, so availability impact is high even without full exploitation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vc4/vc4_kms.c" ], "versions": [ { "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d", "lessThan": "2931db9a5ed219546cf2ae0546698faf78281b89", "status": "affected", "versionType": "git" }, { "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d", "lessThan": "d134c5ff71c7f2320fc7997f2fbbdedf0c76889a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/vc4/vc4_kms.c" ], "versions": [ { "version": "5.12", "status": "affected" }, { "version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.7", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89" }, { "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a" } ], "title": "drm/vc4: kms: Clear the HVS FIFO commit pointer once done", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2021-47533", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-24T19:17:49.041066Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:15:00.137Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:39:59.620Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a", "tags": [ "x_transferred" ] } ] } ] } }