CVE-2021-47063 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm: bridge/panel: Cleanup connector on bridge detach If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1
https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0
https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327
https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2
https://lore.kernel.org/linux-cve-announce/2024022953-CVE-2021-47063-2f50@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-47063
https://www.cve.org/CVERecord?id=CVE-2021-47063

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-29T22:37:37.429Z

Updated: 2024-11-04T11:58:43.052Z

Reserved: 2024-02-29T22:33:44.294Z

Link: CVE-2021-47063

Vulnrichment

Updated: 2024-08-04T05:24:39.562Z

NVD

Status : Awaiting Analysis

Published: 2024-02-29T23:15:07.893

Modified: 2024-03-01T14:04:26.010

Link: CVE-2021-47063

Redhat

Severity : Moderate

Publid Date: 2024-02-29T00:00:00Z

Links: CVE-2021-47063 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47063", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-29T22:33:44.294Z", "datePublished": "2024-02-29T22:37:37.429Z", "dateUpdated": "2024-11-04T11:58:43.052Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:58:43.052Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: bridge/panel: Cleanup connector on bridge detach\n\nIf we don't call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\n\nv2: Cleanup connector only if it was created\n\nv3: Add FIXME\n\nv4: (Use connector->dev) directly in if() block"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/panel.c"], "versions": [{"version": "13dfc0540a57", "lessThan": "ce450934a00c", "status": "affected", "versionType": "git"}, {"version": "13dfc0540a57", "lessThan": "18149b420c9b", "status": "affected", "versionType": "git"}, {"version": "13dfc0540a57", "lessThan": "98d7d76a74e4", "status": "affected", "versionType": "git"}, {"version": "13dfc0540a57", "lessThan": "4d906839d321", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/panel.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.37", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.11.21", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.4", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2"}, {"url": "https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1"}, {"url": "https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327"}, {"url": "https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0"}], "title": "drm: bridge/panel: Cleanup connector on bridge detach", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-01T15:52:26.504965Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:14:08.203Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.562Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.562Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-01T15:52:26.504965Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:14.453Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "drm: bridge/panel: Cleanup connector on bridge detach", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "13dfc0540a57", "lessThan": "ce450934a00c", "versionType": "git"}, {"status": "affected", "version": "13dfc0540a57", "lessThan": "18149b420c9b", "versionType": "git"}, {"status": "affected", "version": "13dfc0540a57", "lessThan": "98d7d76a74e4", "versionType": "git"}, {"status": "affected", "version": "13dfc0540a57", "lessThan": "4d906839d321", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/bridge/panel.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"status": "unaffected", "version": "0", "lessThan": "4.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.37", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.21", "versionType": "semver", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.4", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/bridge/panel.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ce450934a00cf896e648fde08d0bd1426653d7a2"}, {"url": "https://git.kernel.org/stable/c/18149b420c9bd93c443e8d1f48a063d71d9f6aa1"}, {"url": "https://git.kernel.org/stable/c/98d7d76a74e48ec3ddf2e23950adff7edcab9327"}, {"url": "https://git.kernel.org/stable/c/4d906839d321c2efbf3fed4bc31ffd9ff55b75c0"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: bridge/panel: Cleanup connector on bridge detach\n\nIf we don't call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\n\nv2: Cleanup connector only if it was created\n\nv3: Add FIXME\n\nv4: (Use connector->dev) directly in if() block"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T11:58:43.052Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47063", "state": "PUBLISHED", "dateUpdated": "2024-11-04T11:58:43.052Z", "dateReserved": "2024-02-29T22:33:44.294Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-29T22:37:37.429Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: drm: bridge/panel: UAF while Cleanup connector on bridge detach", "id": "2267169", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267169"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm: bridge/panel: Cleanup connector on bridge detach\nIf we don't call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\nv2: Cleanup connector only if it was created\nv3: Add FIXME\nv4: (Use connector->dev) directly in if() block", "A use-after-free flaw was found in the Linux kernel. This may lead to a crash."], "name": "CVE-2021-47063", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47063\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47063\nhttps://lore.kernel.org/linux-cve-announce/2024022953-CVE-2021-47063-2f50@gregkh/T/#u"], "statement": "No Red Hat products are affected by this vulnerability.", "threat_severity": "Moderate", "upstream_fix": "kernel 5.10.37, kernel 5.11.21, kernel 5.12.4, kernel 5.13"}