{"id":"PUB-A-189986136","details":"In tgm_dma_tt_init of tt.c, there is a possible kernel memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-189986136","CVE-2021-20292"],"modified":"2026-03-11T06:34:28.576854Z","published":"2021-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-10-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2021-10-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2021-10-05","severity":"Moderate","fixes":["https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["99760196989237430145374562699292576386","229486327248555091480189875678706106603","36806715450090505409748161799330914059","198713342626075603456915605442523295014","10747102013188388065129342667086014925","83120179611697872073312615012807978291","254440493267405285362787797755120615436","198713342626075603456915605442523295014","82742658958636903326583374865980022811","14875190309410894972600801337859108780","8161385380042865390380087488035071785","198713342626075603456915605442523295014"]},"id":"PUB-A-189986136-62880204","target":{"file":"drivers/gpu/drm/ttm/ttm_tt.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"95250431862744492868366196569261966038","length":383},"id":"PUB-A-189986136-6d47fbd6","target":{"function":"ttm_sg_tt_init","file":"drivers/gpu/drm/ttm/ttm_tt.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["8824410934351240941181826756432675163","133895021803712512708335921558532149274","70979166590252622799742719816518436903","205817275285492178908459014909946591933"]},"id":"PUB-A-189986136-a21e1718","target":{"file":"drivers/gpu/drm/nouveau/nouveau_sgdma.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"320647648374859512842499050818099665047","length":295},"id":"PUB-A-189986136-b7dea2e4","target":{"function":"ttm_dma_tt_init","file":"drivers/gpu/drm/ttm/ttm_tt.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"210051124257186630756131889368541505965","length":231},"id":"PUB-A-189986136-bcd2316d","target":{"function":"ttm_tt_init","file":"drivers/gpu/drm/ttm/ttm_tt.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"241039919280530111255542101175963279308","length":453},"id":"PUB-A-189986136-c13d3003","target":{"function":"nouveau_sgdma_create_ttm","file":"drivers/gpu/drm/nouveau/nouveau_sgdma.c"},"source":"https://android.googlesource.com/kernel/common/+/5de5b6ecf97a021f29403aa272cb4e03318ef586","signature_type":"Function"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/PUB-A-189986136.json"}}],"schema_version":"1.7.5"}