CVE-2021-47445 – This CVE describes a null pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2021-47445?

CVE-2021-47445 has a CVSS score of 5.5 (MEDIUM). This CVE describes a null pointer dereference vulnerability in the Linux kernel's MSM DRM driver. An attacker could potentially cause a kernel panic or system crash by triggering this condition. Systems running affected Linux kernel versions with MSM DRM enabled are vulnerable.

📋 TL;DR

This CVE describes a null pointer dereference vulnerability in the Linux kernel's MSM DRM driver. An attacker could potentially cause a kernel panic or system crash by triggering this condition. Systems running affected Linux kernel versions with MSM DRM enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel with MSM DRM driver

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable if MSM DRM driver is enabled/loaded (typically Qualcomm/Adreno GPU systems)

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, potentially requiring system reboot.

🟠

Likely Case

System instability or crash affecting display functionality.

🟢

If Mitigated

Minimal impact with proper access controls and kernel hardening.

🌐 Internet-Facing: LOW - Requires local access or ability to interact with DRM subsystem.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to interact with DRM subsystem. No known public exploits.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (0cd063aa0a09822cc1620fc59a67fe2f9f6338ac and others)

Vendor Advisory: https://git.kernel.org/stable/c/0cd063aa0a09822cc1620fc59a67fe2f9f6338ac

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Rebuild kernel if compiling from source. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable MSM DRM module

linux

Prevent loading of vulnerable driver if not required

echo 'blacklist msm' >> /etc/modprobe.d/blacklist.conf
rmmod msm

🧯 If You Can't Patch

Restrict local user access to system
Implement kernel hardening (disable unnecessary modules, restrict debugfs access)

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if MSM DRM module is loaded: 'lsmod | grep msm' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and MSM DRM module loads without issues

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference in kernel logs
System crash/reboot events

Network Indicators:

None - local vulnerability

SIEM Query:

source="kernel" AND ("NULL pointer" OR "kernel panic" OR "Oops")

📊 Metadata

CVE ID: CVE-2021-47445

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 22, 2024

Last Updated: January 14, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47445, you might also want to check these: