PT-2021-8002 · Linux+4 · Linux Kernel+4

Paul Cercueil · Published 2021-03-27 · Updated 2024-12-10 · CVE-2021-47063

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the use of memory after it has been freed in the Direct Rendering Manager (DRM) subsystem of the Linux kernel. This occurs due to an incorrect cleanup procedure in the drm connector cleanup() function. If the drm connector cleanup() function is not called manually in panel bridge detach(), the connector will be cleaned up with other DRM objects in the call to drm mode config cleanup(). However, since the drm connector is devm-allocated, by the time drm mode config cleanup() is called, the connector will have already been removed, leading to use-after-free conditions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-01749

CVE-2021-47063

OESA-2024-1483

OESA-2024-1484

OPENSUSE-SU-2024_1489-1

SUSE-SU-2024:1454-1

SUSE-SU-2024:1465-1

SUSE-SU-2024:1489-1

SUSE-SU-2024:1643-1

SUSE-SU-2024:1646-1

SUSE-SU-2024:1870-1

USN-6831-1

USN-6866-1

USN-6866-2

USN-6866-3

USN-6867-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Suse

Ubuntu

References · 730

• https://ubuntu.com/security/CVE-2024-26748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52622 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1489-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26642 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47160 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47159 · Security Note
• https://ubuntu.com/security/CVE-2021-33631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47061 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1646-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47063 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52522 · Security Note
• https://ubuntu.com/security/notices/USN-6867-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26735 · Vendor Advisory