CVE-2021-47081
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory
In the Linux kernel, the following vulnerability has been resolved: habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memory Our code analyzer reported a uaf. In gaudi_memset_device_memory, cb is get via hl_cb_kernel_create() with 2 refcount. If hl_cs_allocate_job() failed, the execution runs into release_cb branch. One ref of cb is dropped by hl_cb_put(cb) and could be freed if other thread also drops one ref. Then cb is used by cb->id later, which is a potential uaf. My patch add a variable 'id' to accept the value of cb->id before the hl_cb_put(cb) is called, to avoid the potential uaf.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 423815bf02e257091d5337be5c63b57fc29e4254 | affected | git | b49f5af30b0e4064fbd91e83823a4bfcb2c7a3e7 | Unavailable | None listed |
| 423815bf02e257091d5337be5c63b57fc29e4254 | affected | git | 115726c5d312b462c9d9931ea42becdfa838a076 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.12 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.12 | Unavailable | None listed |
| 5.12.7 | unaffected | semver | Unavailable | 5.12.* | None listed |
| 5.13 | unaffected | original_commit_for_fix | Unavailable | * | None listed |