In tgmdmatt_init of tt.c, there is a possible kernel memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "99760196989237430145374562699292576386", "229486327248555091480189875678706106603", "36806715450090505409748161799330914059", "198713342626075603456915605442523295014", "10747102013188388065129342667086014925", "83120179611697872073312615012807978291", "254440493267405285362787797755120615436", "198713342626075603456915605442523295014", "82742658958636903326583374865980022811", "14875190309410894972600801337859108780", "8161385380042865390380087488035071785", "198713342626075603456915605442523295014" ] }, "id": "PUB-A-189986136-62880204", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/ttm/ttm_tt.c" }, "signature_type": "Line" }, { "digest": { "length": 383.0, "function_hash": "95250431862744492868366196569261966038" }, "id": "PUB-A-189986136-6d47fbd6", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/ttm/ttm_tt.c", "function": "ttm_sg_tt_init" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "8824410934351240941181826756432675163", "133895021803712512708335921558532149274", "70979166590252622799742719816518436903", "205817275285492178908459014909946591933" ] }, "id": "PUB-A-189986136-a21e1718", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c" }, "signature_type": "Line" }, { "digest": { "length": 295.0, "function_hash": "320647648374859512842499050818099665047" }, "id": "PUB-A-189986136-b7dea2e4", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/ttm/ttm_tt.c", "function": "ttm_dma_tt_init" }, "signature_type": "Function" }, { "digest": { "length": 231.0, "function_hash": "210051124257186630756131889368541505965" }, "id": "PUB-A-189986136-bcd2316d", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/ttm/ttm_tt.c", "function": "ttm_tt_init" }, "signature_type": "Function" }, { "digest": { "length": 453.0, "function_hash": "241039919280530111255542101175963279308" }, "id": "PUB-A-189986136-c13d3003", "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c", "function": "nouveau_sgdma_create_ttm" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" ], "spl": "2021-10-05", "severity": "Moderate", "types": [ "EoP" ] }