CVE-2021-47551 (GCVE-0-2021-47551)
Vulnerability from cvelistv5
Published
2024-05-24 15:09
Modified
2026-08-05 08:48
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again In SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch already been called, the start_cpsch will not be called since there is no resume in this case. When reset been triggered again, driver should avoid to do uninitialization again.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2c99a547bcf9bb8532abd2953479949018449f93
Version: 2c99a547bcf9bb8532abd2953479949018449f93
Version: 2c99a547bcf9bb8532abd2953479949018449f93
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.10.84",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T15:41:59.377852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T13:29:22.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74aafe99efb68f15e50be9f7032c2168512f98a8",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            },
            {
              "lessThan": "06c6f8f86ec243b89e52f0c3dc7062bcb9de74df",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            },
            {
              "lessThan": "2cf49e00d40d5132e3d067b5aa6d84791929ab15",
              "status": "affected",
              "version": "2c99a547bcf9bb8532abd2953479949018449f93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.84",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.7",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\n\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\nalready been called, the start_cpsch will not be called since there is no resume in this\ncase.  When reset been triggered again, driver should avoid to do uninitialization again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable stop_cpsch path is reached during GPU reset of an AMD KFD device (via /dev/kfd or DRM render-node workloads that hang the GPU), requiring local access to the compute/graphics device nodes rather than network packet processing.\nAC:L - An attacker who can submit GPU work can induce an HWS hang that schedules reset; in SRIOV, amdgpu_device_reset_sriov retries after failure and re-enters stop_cpsch without start_cpsch, so the double-uninit is reliably hit once a reset fails or is retried.\nPR:L - Triggering requires only unprivileged access to /dev/kfd or a DRM render node (typically render-group membership), not real root or init-namespace capabilities.\nUI:N - The attacker triggers GPU hang and subsequent reset through their own device ioctls; no separate victim action is required.\nS:U - The double-free and panic occur in the same kernel that hosts the amdkfd driver (including a guest with an SRIOV VF); this does not cross a VM/IOMMU security boundary into the host.\nC:H - stop_cpsch frees dqm-\u003efence_mem without NULLing it, so a second call is a use-after-free of the kfd_mem_obj; per UAF guidance this can be leveraged for arbitrary kernel read/disclosure primitives.\nI:H - The same dangling fence_mem leads to a double kfree and GTT SA bitmap corruption, and pm_uninit is invoked twice on a torn-down packet manager\u2014memory corruption consistent with write/control-flow hijack primitives.\nA:H - The second stop_cpsch causes kernel panic/oops via UAF/double-free and NULL dereference in kernel_queue_uninit(pm-\u003epriv_queue) after priv_queue was already set to NULL."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:20.962Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15"
        }
      ],
      "title": "drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47551",
    "datePublished": "2024-05-24T15:09:54.635Z",
    "dateReserved": "2024-05-24T15:02:54.832Z",
    "dateUpdated": "2026-08-05T08:48:20.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.853Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47551\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-28T15:41:59.377852Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:5.10.84:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.84\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-28T15:50:17.589Z\"}}], \"cna\": {\"title\": \"drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable stop_cpsch path is reached during GPU reset of an AMD KFD device (via /dev/kfd or DRM render-node workloads that hang the GPU), requiring local access to the compute/graphics device nodes rather than network packet processing.\\nAC:L - An attacker who can submit GPU work can induce an HWS hang that schedules reset; in SRIOV, amdgpu_device_reset_sriov retries after failure and re-enters stop_cpsch without start_cpsch, so the double-uninit is reliably hit once a reset fails or is retried.\\nPR:L - Triggering requires only unprivileged access to /dev/kfd or a DRM render node (typically render-group membership), not real root or init-namespace capabilities.\\nUI:N - The attacker triggers GPU hang and subsequent reset through their own device ioctls; no separate victim action is required.\\nS:U - The double-free and panic occur in the same kernel that hosts the amdkfd driver (including a guest with an SRIOV VF); this does not cross a VM/IOMMU security boundary into the host.\\nC:H - stop_cpsch frees dqm-\u003efence_mem without NULLing it, so a second call is a use-after-free of the kfd_mem_obj; per UAF guidance this can be leveraged for arbitrary kernel read/disclosure primitives.\\nI:H - The same dangling fence_mem leads to a double kfree and GTT SA bitmap corruption, and pm_uninit is invoked twice on a torn-down packet manager\\u2014memory corruption consistent with write/control-flow hijack primitives.\\nA:H - The second stop_cpsch causes kernel panic/oops via UAF/double-free and NULL dereference in kernel_queue_uninit(pm-\u003epriv_queue) after priv_queue was already set to NULL.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"74aafe99efb68f15e50be9f7032c2168512f98a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c99a547bcf9bb8532abd2953479949018449f93\", \"lessThan\": \"2cf49e00d40d5132e3d067b5aa6d84791929ab15\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74aafe99efb68f15e50be9f7032c2168512f98a8\"}, {\"url\": \"https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df\"}, {\"url\": \"https://git.kernel.org/stable/c/2cf49e00d40d5132e3d067b5aa6d84791929ab15\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\\n\\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\\nalready been called, the start_cpsch will not be called since there is no resume in this\\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.84\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.7\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"5.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:48:20.962Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47551\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:48:20.962Z\", \"dateReserved\": \"2024-05-24T15:02:54.832Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-24T15:09:54.635Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.