CVE-2021-47489 – This CVE describes an out-of-bounds write vulne... (How to Fix)

Q: What is the severity of CVE-2021-47489?

CVE-2021-47489 has a CVSS score of 7.8 (HIGH). This CVE describes an out-of-bounds write vulnerability in the AMD GPU driver (amdgpu) debugfs interface in the Linux kernel. Attackers with local access can write beyond allocated memory boundaries, potentially leading to privilege escalation or system crashes. Systems using AMD GPUs with affected Linux kernel versions are vulnerable.

📋 TL;DR

This CVE describes an out-of-bounds write vulnerability in the AMD GPU driver (amdgpu) debugfs interface in the Linux kernel. Attackers with local access can write beyond allocated memory boundaries, potentially leading to privilege escalation or system crashes. Systems using AMD GPUs with affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel with AMD GPU driver (amdgpu)

Versions: Linux kernel versions before fixes in stable releases (specific commits: 1336b886b162fdc84708096ea152a61c0e1fc09c, 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5, 9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9)

Operating Systems: Linux distributions with affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires AMD GPU hardware and debugfs access. Debugfs is typically mounted at /sys/kernel/debug and accessible to root by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system instability, or arbitrary code execution in kernel context.

🟠

Likely Case

Local denial of service through kernel panic or system crash, potentially allowing privilege escalation in targeted attacks.

🟢

If Mitigated

Limited impact if debugfs is disabled or access is restricted to privileged users only.

🌐 Internet-Facing: LOW - Requires local access to debugfs interface, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this for privilege escalation or DoS.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and knowledge of debugfs interface. Similar to CVE-2021-42327 which was previously fixed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 1336b886b162fdc84708096ea152a61c0e1fc09c, 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5, 9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9 applied

Vendor Advisory: https://git.kernel.org/stable/c/1336b886b162fdc84708096ea152a61c0e1fc09c

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fixes. 2. Check distribution security advisories for specific patched versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable debugfs access

linux

Prevent non-root users from accessing debugfs interface

mount -o remount,nodev,noexec,nosuid /sys/kernel/debug
chmod 700 /sys/kernel/debug

Restrict debugfs permissions

linux

Limit debugfs access to root only

echo 0 > /proc/sys/kernel/debug/kprobes
chmod 700 /sys/kernel/debug/dri/*

🧯 If You Can't Patch

Restrict local user access to systems with AMD GPUs
Implement strict privilege separation and monitor for suspicious debugfs access

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if AMD GPU driver is loaded: lsmod | grep amdgpu && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check for debugfs access restrictions

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes/panics
Unusual debugfs access patterns in audit logs

Network Indicators:

Not applicable - local exploit only

SIEM Query:

source="kernel" AND ("Oops" OR "panic" OR "BUG") OR source="audit" AND path="/sys/kernel/debug/dri/*"

📊 Metadata

CVE ID: CVE-2021-47489

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 22, 2024

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47489, you might also want to check these: