GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47531 (GCVE-0-2021-47531)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-05-11 13:56
VLAI
Title
drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP In commit 510410bfc034 ("drm/msm: Implement mmap as GEM object function") we switched to a new/cleaner method of doing things. That's good, but we missed a little bit. Before that commit, we used to _first_ run through the drm_gem_mmap_obj() case where `obj->funcs->mmap()` was NULL. That meant that we ran: vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags)); vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot); ...and _then_ we modified those mappings with our own. Now that `obj->funcs->mmap()` is no longer NULL we don't run the default code. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP was important because we're now getting crashes on Chromebooks that use ARC++ while logging out. Specifically a crash that looks like this (this is on a 5.10 kernel w/ relevant backports but also seen on a 5.15 kernel): Unable to handle kernel paging request at virtual address ffffffc008000000 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000 [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003, pud=00000001002b3003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP [...] CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...] Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--) pc : __arch_copy_to_user+0xc0/0x30c lr : copyout+0xac/0x14c [...] Call trace: __arch_copy_to_user+0xc0/0x30c copy_page_to_iter+0x1a0/0x294 process_vm_rw_core+0x240/0x408 process_vm_rw+0x110/0x16c __arm64_sys_process_vm_readv+0x30/0x3c el0_svc_common+0xf8/0x250 do_el0_svc+0x30/0x80 el0_svc+0x10/0x1c el0_sync_handler+0x78/0x108 el0_sync+0x184/0x1c0 Code: f8408423 f80008c3 910020c6 36100082 (b8404423) Let's add the two flags back in. While we're at it, the fact that we aren't running the default means that we _don't_ need to clear out VM_PFNMAP, so remove that and save an instruction. NOTE: it was confirmed that VM_IO was the important flag to fix the problem I was seeing, but adding back VM_DONTDUMP seems like a sane thing to do so I'm doing that too.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:35 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 510410bfc034c57cc3caf1572aa47c1017bab2f9 , < 8e2b7fe5e8a4be5e571561d9afcfbd92097288ba (git)
Affected: 510410bfc034c57cc3caf1572aa47c1017bab2f9 , < 3466d9e217b337bf473ee629c608e53f9f3ab786 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.7 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47531",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:35:23.631797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:21.334Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e2b7fe5e8a4be5e571561d9afcfbd92097288ba",
              "status": "affected",
              "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
              "versionType": "git"
            },
            {
              "lessThan": "3466d9e217b337bf473ee629c608e53f9f3ab786",
              "status": "affected",
              "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix mmap to include VM_IO and VM_DONTDUMP\n\nIn commit 510410bfc034 (\"drm/msm: Implement mmap as GEM object\nfunction\") we switched to a new/cleaner method of doing things. That\u0027s\ngood, but we missed a little bit.\n\nBefore that commit, we used to _first_ run through the\ndrm_gem_mmap_obj() case where `obj-\u003efuncs-\u003emmap()` was NULL. That meant\nthat we ran:\n\n  vma-\u003evm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;\n  vma-\u003evm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u003evm_flags));\n  vma-\u003evm_page_prot = pgprot_decrypted(vma-\u003evm_page_prot);\n\n...and _then_ we modified those mappings with our own. Now that\n`obj-\u003efuncs-\u003emmap()` is no longer NULL we don\u0027t run the default\ncode. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP\nwas important because we\u0027re now getting crashes on Chromebooks that\nuse ARC++ while logging out. Specifically a crash that looks like this\n(this is on a 5.10 kernel w/ relevant backports but also seen on a\n5.15 kernel):\n\n  Unable to handle kernel paging request at virtual address ffffffc008000000\n  Mem abort info:\n    ESR = 0x96000006\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n  Data abort info:\n    ISV = 0, ISS = 0x00000006\n    CM = 0, WnR = 0\n  swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000\n  [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003,\n                     pud=00000001002b3003, pmd=0000000000000000\n  Internal error: Oops: 96000006 [#1] PREEMPT SMP\n  [...]\n  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]\n  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)\n  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : __arch_copy_to_user+0xc0/0x30c\n  lr : copyout+0xac/0x14c\n  [...]\n  Call trace:\n   __arch_copy_to_user+0xc0/0x30c\n   copy_page_to_iter+0x1a0/0x294\n   process_vm_rw_core+0x240/0x408\n   process_vm_rw+0x110/0x16c\n   __arm64_sys_process_vm_readv+0x30/0x3c\n   el0_svc_common+0xf8/0x250\n   do_el0_svc+0x30/0x80\n   el0_svc+0x10/0x1c\n   el0_sync_handler+0x78/0x108\n   el0_sync+0x184/0x1c0\n  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)\n\nLet\u0027s add the two flags back in.\n\nWhile we\u0027re at it, the fact that we aren\u0027t running the default means\nthat we _don\u0027t_ need to clear out VM_PFNMAP, so remove that and save\nan instruction.\n\nNOTE: it was confirmed that VM_IO was the important flag to fix the\nproblem I was seeing, but adding back VM_DONTDUMP seems like a sane\nthing to do so I\u0027m doing that too."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:56:27.930Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
        }
      ],
      "title": "drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47531",
    "datePublished": "2024-05-24T15:09:41.360Z",
    "dateReserved": "2024-05-24T15:02:54.826Z",
    "dateUpdated": "2026-05-11T13:56:27.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47531",
      "date": "2026-09-19",
      "epss": "0.00205",
      "percentile": "0.10889"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix mmap to include VM_IO and VM_DONTDUMP\n\nIn commit 510410bfc034 (\"drm/msm: Implement mmap as GEM object\nfunction\") we switched to a new/cleaner method of doing things. That\u0027s\ngood, but we missed a little bit.\n\nBefore that commit, we used to _first_ run through the\ndrm_gem_mmap_obj() case where `obj-\u003efuncs-\u003emmap()` was NULL. That meant\nthat we ran:\n\n  vma-\u003evm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;\n  vma-\u003evm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u003evm_flags));\n  vma-\u003evm_page_prot = pgprot_decrypted(vma-\u003evm_page_prot);\n\n...and _then_ we modified those mappings with our own. Now that\n`obj-\u003efuncs-\u003emmap()` is no longer NULL we don\u0027t run the default\ncode. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP\nwas important because we\u0027re now getting crashes on Chromebooks that\nuse ARC++ while logging out. Specifically a crash that looks like this\n(this is on a 5.10 kernel w/ relevant backports but also seen on a\n5.15 kernel):\n\n  Unable to handle kernel paging request at virtual address ffffffc008000000\n  Mem abort info:\n    ESR = 0x96000006\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n  Data abort info:\n    ISV = 0, ISS = 0x00000006\n    CM = 0, WnR = 0\n  swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000\n  [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003,\n                     pud=00000001002b3003, pmd=0000000000000000\n  Internal error: Oops: 96000006 [#1] PREEMPT SMP\n  [...]\n  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]\n  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)\n  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : __arch_copy_to_user+0xc0/0x30c\n  lr : copyout+0xac/0x14c\n  [...]\n  Call trace:\n   __arch_copy_to_user+0xc0/0x30c\n   copy_page_to_iter+0x1a0/0x294\n   process_vm_rw_core+0x240/0x408\n   process_vm_rw+0x110/0x16c\n   __arm64_sys_process_vm_readv+0x30/0x3c\n   el0_svc_common+0xf8/0x250\n   do_el0_svc+0x30/0x80\n   el0_svc+0x10/0x1c\n   el0_sync_handler+0x78/0x108\n   el0_sync+0x184/0x1c0\n  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)\n\nLet\u0027s add the two flags back in.\n\nWhile we\u0027re at it, the fact that we aren\u0027t running the default means\nthat we _don\u0027t_ need to clear out VM_PFNMAP, so remove that and save\nan instruction.\n\nNOTE: it was confirmed that VM_IO was the important flag to fix the\nproblem I was seeing, but adding back VM_DONTDUMP seems like a sane\nthing to do so I\u0027m doing that too."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm: corrige mmap para incluir VM_IO y VM_DONTDUMP. En el commit 510410bfc034 (\"drm/msm: implementa mmap como funci\u00f3n de objeto GEM\") Nosotros cambiamos a un m\u00e9todo nuevo / m\u00e1s limpio de hacer las cosas. Eso es bueno, pero nos perdimos un poquito. Antes de esa confirmaci\u00f3n, sol\u00edamos ejecutar _primero_ el caso drm_gem_mmap_obj() donde `obj-\u0026gt;funcs-\u0026gt;mmap()` era NULL. Eso signific\u00f3 que ejecutamos: vma-\u0026gt;vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; vma-\u0026gt;vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u0026gt;vm_flags)); vma-\u0026gt;vm_page_prot = pgprot_decrypted(vma-\u0026gt;vm_page_prot); ...y _luego_ modificamos esas asignaciones con las nuestras. Ahora que `obj-\u0026gt;funcs-\u0026gt;mmap()` ya no es NULL, no ejecutamos el c\u00f3digo predeterminado. Parece que el hecho de que vm_flags obtuviera VM_IO/VM_DONTDUMP fue importante porque ahora estamos teniendo fallas en Chromebooks que usan ARC++ al cerrar sesi\u00f3n. Espec\u00edficamente, un bloqueo que se ve as\u00ed (esto ocurre en un kernel 5.10 con backports relevantes, pero tambi\u00e9n se ve en un kernel 5.15): No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffffffc008000000 Informaci\u00f3n de cancelaci\u00f3n de memoria: ESR = 0x96000006 EC = 0x25: DABT ( EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Informaci\u00f3n de cancelaci\u00f3n de datos: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 tabla de intercambio: 4k p\u00e1ginas, VA de 39 bits , pgdp=000000008293d000 [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003, pud=00000001002b3003, pmd=0000000000000000 Error interno: operaciones: 96000006 [#1] PREEMPT SMP [...] CPU: 7 PID: 15734 Comunicaciones: crash_dump64 Contaminado: GW 5.10.67 #1 [...] Nombre del hardware: Qualcomm Technologies, Inc. sc7280 IDP SKU2 plataforma (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--) pc: __arch_copy_to_user+0xc0/0x30c lr: copyout+0xac/0x14c [...] Rastreo de llamadas: __arch_copy_to_user+0xc0/0x30c copy_page_to_iter+0x1a0/0x294 Process_vm_rw_core+0x240/0x408 Process_vm_rw+0x110/0x16c __arm64_sys_process_vm_readv+0x30/0 x3c el0_svc_common+0xf8/0x250 do_el0_svc+0x30/0x80 el0_svc+0x10/0x1c el0_sync_handler+0x78/0x108 el0_sync+0x184/0x1c0 C\u00f3digo: f8408423 f80008c3 910020c6 36100082 (b8404423) Agreguemos las dos banderas nuevamente. Mientras estamos en esto, el hecho de que no estemos ejecutando medios predeterminados que _no_ necesitamos borrar VM_PFNMAP, as\u00ed que elim\u00ednelo y guarde una instrucci\u00f3n. NOTA: se confirm\u00f3 que VM_IO era el indicador importante para solucionar el problema que estaba viendo, pero volver a agregar VM_DONTDUMP parece algo sensato, as\u00ed que lo estoy haciendo tambi\u00e9n."
        }
      ],
      "id": "CVE-2021-47531",
      "lastModified": "2024-11-21T06:36:28.120",
      "published": "2024-05-24T15:15:16.357",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8e2b7fe5e8a4be5e571561d9afcfbd92097288ba",
                    "status": "affected",
                    "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3466d9e217b337bf473ee629c608e53f9f3ab786",
                    "status": "affected",
                    "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E524C2AB-B061-43A9-8F32-C09C86BC2479",
                    "versionEndExcluding": "5.15.7",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A73429BA-C2D9-4D0C-A75F-06A1CA8B3983",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F621B5E3-E99D-49E7-90B9-EC3B77C95383",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix mmap to include VM_IO and VM_DONTDUMP\n\nIn commit 510410bfc034 (\"drm/msm: Implement mmap as GEM object\nfunction\") we switched to a new/cleaner method of doing things. That\u0027s\ngood, but we missed a little bit.\n\nBefore that commit, we used to _first_ run through the\ndrm_gem_mmap_obj() case where `obj-\u003efuncs-\u003emmap()` was NULL. That meant\nthat we ran:\n\n  vma-\u003evm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;\n  vma-\u003evm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u003evm_flags));\n  vma-\u003evm_page_prot = pgprot_decrypted(vma-\u003evm_page_prot);\n\n...and _then_ we modified those mappings with our own. Now that\n`obj-\u003efuncs-\u003emmap()` is no longer NULL we don\u0027t run the default\ncode. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP\nwas important because we\u0027re now getting crashes on Chromebooks that\nuse ARC++ while logging out. Specifically a crash that looks like this\n(this is on a 5.10 kernel w/ relevant backports but also seen on a\n5.15 kernel):\n\n  Unable to handle kernel paging request at virtual address ffffffc008000000\n  Mem abort info:\n    ESR = 0x96000006\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n  Data abort info:\n    ISV = 0, ISS = 0x00000006\n    CM = 0, WnR = 0\n  swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000\n  [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003,\n                     pud=00000001002b3003, pmd=0000000000000000\n  Internal error: Oops: 96000006 [#1] PREEMPT SMP\n  [...]\n  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]\n  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)\n  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : __arch_copy_to_user+0xc0/0x30c\n  lr : copyout+0xac/0x14c\n  [...]\n  Call trace:\n   __arch_copy_to_user+0xc0/0x30c\n   copy_page_to_iter+0x1a0/0x294\n   process_vm_rw_core+0x240/0x408\n   process_vm_rw+0x110/0x16c\n   __arm64_sys_process_vm_readv+0x30/0x3c\n   el0_svc_common+0xf8/0x250\n   do_el0_svc+0x30/0x80\n   el0_svc+0x10/0x1c\n   el0_sync_handler+0x78/0x108\n   el0_sync+0x184/0x1c0\n  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)\n\nLet\u0027s add the two flags back in.\n\nWhile we\u0027re at it, the fact that we aren\u0027t running the default means\nthat we _don\u0027t_ need to clear out VM_PFNMAP, so remove that and save\nan instruction.\n\nNOTE: it was confirmed that VM_IO was the important flag to fix the\nproblem I was seeing, but adding back VM_DONTDUMP seems like a sane\nthing to do so I\u0027m doing that too."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm: corrige mmap para incluir VM_IO y VM_DONTDUMP. En el commit 510410bfc034 (\"drm/msm: implementa mmap como funci\u00f3n de objeto GEM\") Nosotros cambiamos a un m\u00e9todo nuevo / m\u00e1s limpio de hacer las cosas. Eso es bueno, pero nos perdimos un poquito. Antes de esa confirmaci\u00f3n, sol\u00edamos ejecutar _primero_ el caso drm_gem_mmap_obj() donde `obj-\u0026gt;funcs-\u0026gt;mmap()` era NULL. Eso signific\u00f3 que ejecutamos: vma-\u0026gt;vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; vma-\u0026gt;vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u0026gt;vm_flags)); vma-\u0026gt;vm_page_prot = pgprot_decrypted(vma-\u0026gt;vm_page_prot); ...y _luego_ modificamos esas asignaciones con las nuestras. Ahora que `obj-\u0026gt;funcs-\u0026gt;mmap()` ya no es NULL, no ejecutamos el c\u00f3digo predeterminado. Parece que el hecho de que vm_flags obtuviera VM_IO/VM_DONTDUMP fue importante porque ahora estamos teniendo fallas en Chromebooks que usan ARC++ al cerrar sesi\u00f3n. Espec\u00edficamente, un bloqueo que se ve as\u00ed (esto ocurre en un kernel 5.10 con backports relevantes, pero tambi\u00e9n se ve en un kernel 5.15): No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual ffffffc008000000 Informaci\u00f3n de cancelaci\u00f3n de memoria: ESR = 0x96000006 EC = 0x25: DABT ( EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Informaci\u00f3n de cancelaci\u00f3n de datos: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 tabla de intercambio: 4k p\u00e1ginas, VA de 39 bits , pgdp=000000008293d000 [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003, pud=00000001002b3003, pmd=0000000000000000 Error interno: operaciones: 96000006 [#1] PREEMPT SMP [...] CPU: 7 PID: 15734 Comunicaciones: crash_dump64 Contaminado: GW 5.10.67 #1 [...] Nombre del hardware: Qualcomm Technologies, Inc. sc7280 IDP SKU2 plataforma (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--) pc: __arch_copy_to_user+0xc0/0x30c lr: copyout+0xac/0x14c [...] Rastreo de llamadas: __arch_copy_to_user+0xc0/0x30c copy_page_to_iter+0x1a0/0x294 Process_vm_rw_core+0x240/0x408 Process_vm_rw+0x110/0x16c __arm64_sys_process_vm_readv+0x30/0 x3c el0_svc_common+0xf8/0x250 do_el0_svc+0x30/0x80 el0_svc+0x10/0x1c el0_sync_handler+0x78/0x108 el0_sync+0x184/0x1c0 C\u00f3digo: f8408423 f80008c3 910020c6 36100082 (b8404423) Agreguemos las dos banderas nuevamente. Mientras estamos en esto, el hecho de que no estemos ejecutando medios predeterminados que _no_ necesitamos borrar VM_PFNMAP, as\u00ed que elim\u00ednelo y guarde una instrucci\u00f3n. NOTA: se confirm\u00f3 que VM_IO era el indicador importante para solucionar el problema que estaba viendo, pero volver a agregar VM_DONTDUMP parece algo sensato, as\u00ed que lo estoy haciendo tambi\u00e9n."
          }
        ],
        "id": "CVE-2021-47531",
        "lastModified": "2026-06-17T04:17:42.267",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47531",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:35:23.631797Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-24T15:15:16.357",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T10:48:04+00:00",
      "cve": "CVE-2021-47531",
      "id": "CVE-2021-47531",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47531.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:37:28Z",
      "cve": "CVE-2021-47531",
      "id": "CVE-2021-47531",
      "initial_release_date": "2024-05-28T15:29:42Z",
      "product_status:known_affected": "315",
      "product_status:known_not_affected": "323",
      "product_status:recommended": "313",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47531",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47531.json",
      "version": "53"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:39:59.773Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47531",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:35:23.631797Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:16.295Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/msm/msm_gem.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "8e2b7fe5e8a4be5e571561d9afcfbd92097288ba",
                  "status": "affected",
                  "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
                  "versionType": "git"
                },
                {
                  "lessThan": "3466d9e217b337bf473ee629c608e53f9f3ab786",
                  "status": "affected",
                  "version": "510410bfc034c57cc3caf1572aa47c1017bab2f9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/msm/msm_gem.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.15"
                },
                {
                  "lessThan": "5.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.16",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.7",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix mmap to include VM_IO and VM_DONTDUMP\n\nIn commit 510410bfc034 (\"drm/msm: Implement mmap as GEM object\nfunction\") we switched to a new/cleaner method of doing things. That\u0027s\ngood, but we missed a little bit.\n\nBefore that commit, we used to _first_ run through the\ndrm_gem_mmap_obj() case where `obj-\u003efuncs-\u003emmap()` was NULL. That meant\nthat we ran:\n\n  vma-\u003evm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;\n  vma-\u003evm_page_prot = pgprot_writecombine(vm_get_page_prot(vma-\u003evm_flags));\n  vma-\u003evm_page_prot = pgprot_decrypted(vma-\u003evm_page_prot);\n\n...and _then_ we modified those mappings with our own. Now that\n`obj-\u003efuncs-\u003emmap()` is no longer NULL we don\u0027t run the default\ncode. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP\nwas important because we\u0027re now getting crashes on Chromebooks that\nuse ARC++ while logging out. Specifically a crash that looks like this\n(this is on a 5.10 kernel w/ relevant backports but also seen on a\n5.15 kernel):\n\n  Unable to handle kernel paging request at virtual address ffffffc008000000\n  Mem abort info:\n    ESR = 0x96000006\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n  Data abort info:\n    ISV = 0, ISS = 0x00000006\n    CM = 0, WnR = 0\n  swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000\n  [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003,\n                     pud=00000001002b3003, pmd=0000000000000000\n  Internal error: Oops: 96000006 [#1] PREEMPT SMP\n  [...]\n  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]\n  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)\n  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : __arch_copy_to_user+0xc0/0x30c\n  lr : copyout+0xac/0x14c\n  [...]\n  Call trace:\n   __arch_copy_to_user+0xc0/0x30c\n   copy_page_to_iter+0x1a0/0x294\n   process_vm_rw_core+0x240/0x408\n   process_vm_rw+0x110/0x16c\n   __arm64_sys_process_vm_readv+0x30/0x3c\n   el0_svc_common+0xf8/0x250\n   do_el0_svc+0x30/0x80\n   el0_svc+0x10/0x1c\n   el0_sync_handler+0x78/0x108\n   el0_sync+0x184/0x1c0\n  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)\n\nLet\u0027s add the two flags back in.\n\nWhile we\u0027re at it, the fact that we aren\u0027t running the default means\nthat we _don\u0027t_ need to clear out VM_PFNMAP, so remove that and save\nan instruction.\n\nNOTE: it was confirmed that VM_IO was the important flag to fix the\nproblem I was seeing, but adding back VM_DONTDUMP seems like a sane\nthing to do so I\u0027m doing that too."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T07:12:58.096Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"
            },
            {
              "url": "https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786"
            }
          ],
          "title": "drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47531",
        "datePublished": "2024-05-24T15:09:41.360Z",
        "dateReserved": "2024-05-24T15:02:54.826Z",
        "dateUpdated": "2025-05-04T07:12:58.096Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.