CVE-2021-47531

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP

In commit 510410bfc034 ("drm/msm: Implement mmap as GEM object

function") we switched to a new/cleaner method of doing things. That's

good, but we missed a little bit.

Before that commit, we used to _first_ run through the

drm_gem_mmap_obj() case where `obj->funcs->mmap()` was NULL. That meant

that we ran:

vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;

vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));

vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);

...and _then_ we modified those mappings with our own. Now that

`obj->funcs->mmap()` is no longer NULL we don't run the default

code. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP

was important because we're now getting crashes on Chromebooks that

use ARC++ while logging out. Specifically a crash that looks like this

(this is on a 5.10 kernel w

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References