{"id":"CVE-2021-47535","state":"PUBLISHED","title":"drm/msm/a6xx: Allocate enough space for GMU registers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a6xx: Allocate enough space for GMU registers\n\nIn commit 142639a52a01 (\"drm/msm/a6xx: fix crashstate capture for\nA650\") we changed a6xx_get_gmu_registers() to read 3 sets of\nregisters. Unfortunately, we didn't change the memory allocation for\nthe array. That leads to a KASAN warning (this was on the chromeos-5.4\nkernel, which has the problematic commit backported to it):\n\n  BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430\n  Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209\n  CPU: 5 PID: 209 Comm: A618-worker Tainted: G        W         5.4.156-lockdep #22\n  Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT)\n  Call trace:\n   dump_backtrace+0x0/0x248\n   show_stack+0x20/0x2c\n   dump_stack+0x128/0x1ec\n   print_address_description+0x88/0x4a0\n   __kasan_report+0xfc/0x120\n   kasan_report+0x10/0x18\n   __asan_report_store8_noabort+0x1c/0x24\n   _a6xx_get_gmu_registers+0x144/0x430\n   a6xx_gpu_state_get+0x330/0x25d4\n   msm_gpu_crashstate_capture+0xa0/0x84c\n   recover_worker+0x328/0x838\n   kthread_worker_fn+0x32c/0x574\n   kthread+0x2dc/0x39c\n   ret_from_fork+0x10/0x18\n\n  Allocated by task 209:\n   __kasan_kmalloc+0xfc/0x1c4\n   kasan_kmalloc+0xc/0x14\n   kmem_cache_alloc_trace+0x1f0/0x2a0\n   a6xx_gpu_state_get+0x164/0x25d4\n   msm_gpu_crashstate_capture+0xa0/0x84c\n   recover_worker+0x328/0x838\n   kthread_worker_fn+0x32c/0x574\n   kthread+0x2dc/0x39c\n   ret_from_fork+0x10/0x18","publishedAt":"2024-05-24T15:09:43.994Z","updatedAt":"2026-08-05T08:48:16.665Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"d646856a600e8635ba498f20b194219b158626e8","versionType":"git"},{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"83e54fcf0b14ca2d869dd37abe1bb6542805f538","versionType":"git"},{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"b4d25abf9720b69a03465b09d0d62d1998ed6708","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"5.10.84","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.7","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c"]}],"references":["https://git.kernel.org/stable/c/d646856a600e8635ba498f20b194219b158626e8","https://git.kernel.org/stable/c/83e54fcf0b14ca2d869dd37abe1bb6542805f538","https://git.kernel.org/stable/c/b4d25abf9720b69a03465b09d0d62d1998ed6708"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47535.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47535","state":"PUBLISHED","datePublished":"2024-05-24T15:09:43.994Z","dateUpdated":"2026-08-05T08:48:16.665Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-24T15:02:54.826Z"},"containers":{"cna":{"title":"drm/msm/a6xx: Allocate enough space for GMU registers","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a6xx: Allocate enough space for GMU registers\n\nIn commit 142639a52a01 (\"drm/msm/a6xx: fix crashstate capture for\nA650\") we changed a6xx_get_gmu_registers() to read 3 sets of\nregisters. Unfortunately, we didn't change the memory allocation for\nthe array. That leads to a KASAN warning (this was on the chromeos-5.4\nkernel, which has the problematic commit backported to it):\n\n  BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430\n  Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209\n  CPU: 5 PID: 209 Comm: A618-worker Tainted: G        W         5.4.156-lockdep #22\n  Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT)\n  Call trace:\n   dump_backtrace+0x0/0x248\n   show_stack+0x20/0x2c\n   dump_stack+0x128/0x1ec\n   print_address_description+0x88/0x4a0\n   __kasan_report+0xfc/0x120\n   kasan_report+0x10/0x18\n   __asan_report_store8_noabort+0x1c/0x24\n   _a6xx_get_gmu_registers+0x144/0x430\n   a6xx_gpu_state_get+0x330/0x25d4\n   msm_gpu_crashstate_capture+0xa0/0x84c\n   recover_worker+0x328/0x838\n   kthread_worker_fn+0x32c/0x574\n   kthread+0x2dc/0x39c\n   ret_from_fork+0x10/0x18\n\n  Allocated by task 209:\n   __kasan_kmalloc+0xfc/0x1c4\n   kasan_kmalloc+0xc/0x14\n   kmem_cache_alloc_trace+0x1f0/0x2a0\n   a6xx_gpu_state_get+0x164/0x25d4\n   msm_gpu_crashstate_capture+0xa0/0x84c\n   recover_worker+0x328/0x838\n   kthread_worker_fn+0x32c/0x574\n   kthread+0x2dc/0x39c\n   ret_from_fork+0x10/0x18"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"d646856a600e8635ba498f20b194219b158626e8","versionType":"git"},{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"83e54fcf0b14ca2d869dd37abe1bb6542805f538","versionType":"git"},{"version":"142639a52a01e90c512a9a8d2156997e02a65b53","status":"affected","lessThan":"b4d25abf9720b69a03465b09d0d62d1998ed6708","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.9","versionType":"semver"},{"version":"5.10.84","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.7","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d646856a600e8635ba498f20b194219b158626e8"},{"url":"https://git.kernel.org/stable/c/83e54fcf0b14ca2d869dd37abe1bb6542805f538"},{"url":"https://git.kernel.org/stable/c/b4d25abf9720b69a03465b09d0d62d1998ed6708"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The OOB write runs during GPU hang/fault crashstate capture reached via local MSM_GEM_SUBMIT on /dev/dri/renderD*; there is no network or adjacent-protocol path into a6xx_get_gmu_registers().\nAC:L - An attacker can reliably hang or fault the Adreno GPU with crafted submits, and DRM_MSM selects WANT_DEV_COREDUMP so crashstate capture (the vulnerable path) runs by default; the KASAN report confirms the OOB write is hit deterministically on recover_worker.\nPR:L - MSM_GEM_SUBMIT is DRM_RENDER_ALLOW with no root/CAP requirement; on msm/Adreno platforms (Android phones, ChromeOS) an unprivileged local user or app can open the render node and submit work.\nUI:N - The attacker submits hang-inducing or faulting GPU work themselves; no separate victim action is required.\nS:U - Impact is host-kernel slab corruption within the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The slab out-of-bounds write of a6xx_gpu_state_obj fields into adjacent heap memory is memory corruption that can be leveraged for information disclosure per OOB-write guidance.\nI:H - Writing handle/data pointers past a 2-element gmu_registers allocation is a heap out-of-bounds write, enabling adjacent-object corruption and control-flow hijacking primitives.\nA:H - The documented KASAN slab-out-of-bounds write during recover_worker can oops/panic the kernel, so availability impact is High even without full exploitation."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:48:16.665Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.10.84"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.15.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.2,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-17T17:34:34.685290Z","id":"CVE-2021-47535","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","type":"CWE","lang":"en","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-04T18:09:25.843Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/d646856a600e8635ba498f20b194219b158626e8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/83e54fcf0b14ca2d869dd37abe1bb6542805f538","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b4d25abf9720b69a03465b09d0d62d1998ed6708","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:39:59.827Z"}}]}}}