CVE-2021-20292

Published: 24 March 2021

There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.

From the Ubuntu Security Team

It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A privileged attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

kernels with CONFIG_SLAB_FREELIST_HARDENED=y (which Ubuntu
enables) are probably not affected.

Priority

Low

CVSS 3 base score: 6.7

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20292
• https://bugzilla.redhat.com/show_bug.cgi?id=1939686
• https://git.kernel.org/linus/5de5b6ecf97a021f29403aa272cb4e03318ef586
• https://ubuntu.com/security/notices/USN-4946-1
• https://ubuntu.com/security/notices/USN-5343-1
• NVD
• Launchpad
• Debian