Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2021-47657drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.17.3-1DEBIAN-CVE-2021-47657
Debian:13linux5.17.3-1DEBIAN-CVE-2021-47657
Debian:14linux5.17.3-1DEBIAN-CVE-2021-47657
Ubuntu:22.04:LTSlinux5.15.0-37.39UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-aws5.15.0-1011.14UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure5.15.0-1010.12UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-gcp5.15.0-1008.12UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-gke5.15.0-1008.10UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-ibm5.15.0-1007.8UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1008.11UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-kvm5.15.0-1010.11UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-37.39UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oracle5.15.0-1009.12UBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-raspi5.15.0-1011.13UBUNTU-CVE-2021-47657
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47657
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2021-47657

Affected products (as reported)

VendorProductVersions
Linux Linux 377f8331d0565e6f71ba081c894029a92d0c7e77 – before b094fece3810c71ceee6f0921676cb65d4e68c5a377f8331d0565e6f71ba081c894029a92d0c7e77 – before ac92b474eeeed75b8660374ba1d129a121c09da8377f8331d0565e6f71ba081c894029a92d0c7e77 – before abc9ad36df16e27ac1c665085157f1a082d39bac377f8331d0565e6f71ba081c894029a92d0c7e77 – before 6b79f96f4a23846516e5e6e4dd37fc06f43a60dd244dbb4abe123779ec30e7c6ca283a681aba5c941016c0f62f73d5d2c3a5d1ad1e1fb0cdce1993ae5.11.20 – before 5.125.12.3 – before 5.13
Linux Linux 5.13

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References