{"id":"CVE-2021-47447","state":"PUBLISHED","title":"drm/msm/a3xx: fix error handling in a3xx_gpu_init()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a3xx: fix error handling in a3xx_gpu_init()\n\nThese error paths returned 1 on failure, instead of a negative error\ncode.  This would lead to an Oops in the caller.  A second problem is\nthat the check for \"if (ret != -ENODATA)\" did not work because \"ret\" was\nset to 1.","publishedAt":"2024-05-22T06:19:39.506Z","updatedAt":"2026-08-05T08:47:50.874Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5785dd7a8ef0de8049f40a1a109de6a1bf17b479","status":"affected","lessThan":"d59e44e7821a8f2bb6f2e846b9167397a5f01608","versionType":"git"},{"version":"5785dd7a8ef0de8049f40a1a109de6a1bf17b479","status":"affected","lessThan":"3eda901995371d390ef82d0b6462f4ea8efbcfdf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a3xx_gpu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.14.14","status":"unaffected","lessThanOrEqual":"5.14.*","versionType":"semver"},{"version":"5.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a3xx_gpu.c"]}],"references":["https://git.kernel.org/stable/c/d59e44e7821a8f2bb6f2e846b9167397a5f01608","https://git.kernel.org/stable/c/3eda901995371d390ef82d0b6462f4ea8efbcfdf"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47447.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47447","state":"PUBLISHED","datePublished":"2024-05-22T06:19:39.506Z","dateUpdated":"2026-08-05T08:47:50.874Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-21T14:58:30.832Z"},"containers":{"cna":{"title":"drm/msm/a3xx: fix error handling in a3xx_gpu_init()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a3xx: fix error handling in a3xx_gpu_init()\n\nThese error paths returned 1 on failure, instead of a negative error\ncode.  This would lead to an Oops in the caller.  A second problem is\nthat the check for \"if (ret != -ENODATA)\" did not work because \"ret\" was\nset to 1."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5785dd7a8ef0de8049f40a1a109de6a1bf17b479","status":"affected","lessThan":"d59e44e7821a8f2bb6f2e846b9167397a5f01608","versionType":"git"},{"version":"5785dd7a8ef0de8049f40a1a109de6a1bf17b479","status":"affected","lessThan":"3eda901995371d390ef82d0b6462f4ea8efbcfdf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a3xx_gpu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.14.14","status":"unaffected","lessThanOrEqual":"5.14.*","versionType":"semver"},{"version":"5.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a3xx_gpu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d59e44e7821a8f2bb6f2e846b9167397a5f01608"},{"url":"https://git.kernel.org/stable/c/3eda901995371d390ef82d0b6462f4ea8efbcfdf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in the MSM Adreno a3xx GPU bind/init path (adreno_bind→a3xx_gpu_init) and is later exercised via local DRM open (msm_open→adreno_load_gpu) or local PM/unbind callbacks on Qualcomm a3xx devices, not via network or adjacent-link protocols.\nAC:L - On affected configurations where of_icc_get fails (including the explicitly optional ocmem -ENODATA case), the wrong IS_ERR→ERR_PTR(1) path is deterministic: bind incorrectly succeeds after destroying the GPU, and a subsequent DRM open reliably hits the dangling drvdata with no attacker-uncontrollable race.\nPR:L - Triggering the use path only requires opening the local DRM device (/dev/dri/renderD* or card node), which is available to an ordinary unprivileged user or Android app in the video/render group; per guidance, choose PR:L over PR:H.\nUI:N - The attacker opens the DRM device (or otherwise exercises the GPU path) themselves; no separate victim interaction is required.\nS:U - Impact is confined to the host kernel (oops or local privilege-escalation class memory unsafety) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - a3xx_destroy frees the msm_gpu while platform drvdata still points at it (msm_gpu_cleanup did not clear drvdata in the vulnerable window), yielding a UAF; reclaiming that object enables arbitrary kernel read primitives, so Confidentiality is High.\nI:H - The UAF'd msm_gpu contains function pointers (gpu->funcs) used by adreno_load_gpu/msm_gpu_hw_init and related paths; heap spraying the freed object provides a control-flow hijack / arbitrary write primitive, so Integrity is High.\nA:H - Using the dangling GPU pointer causes a kernel oops/panic (as described in the fix), which is a full availability impact under CVSS kernel guidance."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:47:50.874Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.14.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-47447","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-22T15:54:08.510506Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:14:50.049Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/d59e44e7821a8f2bb6f2e846b9167397a5f01608","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3eda901995371d390ef82d0b6462f4ea8efbcfdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:39:59.478Z"}}]}}}