PUB-A-189986136

See a problem?
Import Source
https://storage.googleapis.com/android-osv/PUB-A-189986136.json
JSON Data
https://api.osv.dev/v1/vulns/PUB-A-189986136
Aliases
Published
2021-10-01T00:00:00Z
Modified
2025-11-20T16:40:03.878765Z
Summary
[none]
Details

In tgmdmatt_init of tt.c, there is a possible kernel memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2021-10-05

Affected versions

Other

Kernel

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "severity": "Moderate",
    "vanir_signatures": [
        {
            "id": "PUB-A-189986136-62880204",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "drivers/gpu/drm/ttm/ttm_tt.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "line_hashes": [
                    "99760196989237430145374562699292576386",
                    "229486327248555091480189875678706106603",
                    "36806715450090505409748161799330914059",
                    "198713342626075603456915605442523295014",
                    "10747102013188388065129342667086014925",
                    "83120179611697872073312615012807978291",
                    "254440493267405285362787797755120615436",
                    "198713342626075603456915605442523295014",
                    "82742658958636903326583374865980022811",
                    "14875190309410894972600801337859108780",
                    "8161385380042865390380087488035071785",
                    "198713342626075603456915605442523295014"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line"
        },
        {
            "id": "PUB-A-189986136-6d47fbd6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "ttm_sg_tt_init",
                "file": "drivers/gpu/drm/ttm/ttm_tt.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "length": 383.0,
                "function_hash": "95250431862744492868366196569261966038"
            },
            "signature_type": "Function"
        },
        {
            "id": "PUB-A-189986136-a21e1718",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "line_hashes": [
                    "8824410934351240941181826756432675163",
                    "133895021803712512708335921558532149274",
                    "70979166590252622799742719816518436903",
                    "205817275285492178908459014909946591933"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line"
        },
        {
            "id": "PUB-A-189986136-b7dea2e4",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "ttm_dma_tt_init",
                "file": "drivers/gpu/drm/ttm/ttm_tt.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "length": 295.0,
                "function_hash": "320647648374859512842499050818099665047"
            },
            "signature_type": "Function"
        },
        {
            "id": "PUB-A-189986136-bcd2316d",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "ttm_tt_init",
                "file": "drivers/gpu/drm/ttm/ttm_tt.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "length": 231.0,
                "function_hash": "210051124257186630756131889368541505965"
            },
            "signature_type": "Function"
        },
        {
            "id": "PUB-A-189986136-c13d3003",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "nouveau_sgdma_create_ttm",
                "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c"
            },
            "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586",
            "digest": {
                "length": 453.0,
                "function_hash": "241039919280530111255542101175963279308"
            },
            "signature_type": "Function"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586"
    ],
    "spl": "2021-10-05"
}