In tgmdmatt_init of tt.c, there is a possible kernel memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "severity": "Moderate", "fixes": [ "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" ], "types": [ "EoP" ], "vanir_signatures": [ { "id": "PUB-A-189986136-62880204", "deprecated": false, "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/ttm/ttm_tt.c" }, "digest": { "line_hashes": [ "99760196989237430145374562699292576386", "229486327248555091480189875678706106603", "36806715450090505409748161799330914059", "198713342626075603456915605442523295014", "10747102013188388065129342667086014925", "83120179611697872073312615012807978291", "254440493267405285362787797755120615436", "198713342626075603456915605442523295014", "82742658958636903326583374865980022811", "14875190309410894972600801337859108780", "8161385380042865390380087488035071785", "198713342626075603456915605442523295014" ], "threshold": 0.9 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" }, { "id": "PUB-A-189986136-6d47fbd6", "deprecated": false, "signature_type": "Function", "signature_version": "v1", "target": { "function": "ttm_sg_tt_init", "file": "drivers/gpu/drm/ttm/ttm_tt.c" }, "digest": { "function_hash": "95250431862744492868366196569261966038", "length": 383.0 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" }, { "id": "PUB-A-189986136-a21e1718", "deprecated": false, "signature_type": "Line", "signature_version": "v1", "target": { "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c" }, "digest": { "line_hashes": [ "8824410934351240941181826756432675163", "133895021803712512708335921558532149274", "70979166590252622799742719816518436903", "205817275285492178908459014909946591933" ], "threshold": 0.9 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" }, { "id": "PUB-A-189986136-b7dea2e4", "deprecated": false, "signature_type": "Function", "signature_version": "v1", "target": { "function": "ttm_dma_tt_init", "file": "drivers/gpu/drm/ttm/ttm_tt.c" }, "digest": { "function_hash": "320647648374859512842499050818099665047", "length": 295.0 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" }, { "id": "PUB-A-189986136-bcd2316d", "deprecated": false, "signature_type": "Function", "signature_version": "v1", "target": { "function": "ttm_tt_init", "file": "drivers/gpu/drm/ttm/ttm_tt.c" }, "digest": { "function_hash": "210051124257186630756131889368541505965", "length": 231.0 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" }, { "id": "PUB-A-189986136-c13d3003", "deprecated": false, "signature_type": "Function", "signature_version": "v1", "target": { "function": "nouveau_sgdma_create_ttm", "file": "drivers/gpu/drm/nouveau/nouveau_sgdma.c" }, "digest": { "function_hash": "241039919280530111255542101175963279308", "length": 453.0 }, "source": "https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586" } ], "spl": "2021-10-05" }