CVE-2021-47445 in Linux
Summary
by MITRE • 05/22/2024
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix null pointer dereference on pointer edp
The initialization of pointer dev dereferences pointer edp before edp is null checked, so there is a potential null pointer deference issue. Fix this by only dereferencing edp after edp has been null checked.
Addresses-Coverity: ("Dereference before null check")
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/22/2025
The vulnerability identified as CVE-2021-47445 represents a critical null pointer dereference flaw within the Linux kernel's display subsystem, specifically affecting the drm/msm driver component. This issue resides in the device initialization sequence where the kernel attempts to access a pointer variable named edp without first validating whether it contains a valid memory reference. The flaw occurs during the early stages of device setup when the driver processes external display protocol connections, making it particularly dangerous as it can potentially crash the entire system or create exploitable conditions during normal operation.
The technical implementation of this vulnerability stems from improper control flow in the driver initialization logic where the dev pointer is dereferenced before the edp pointer undergoes null validation. According to CWE-476, this constitutes a null pointer dereference condition that violates fundamental programming practices for memory safety. The flaw manifests when the driver attempts to access device properties or configuration data through the edp pointer, which may remain uninitialized or set to NULL due to failed hardware detection or allocation processes. This pattern creates a race condition or initialization error where subsequent code execution attempts to utilize a null reference, leading to immediate system termination or unpredictable behavior.
From an operational perspective, this vulnerability poses significant risks to embedded systems and mobile devices that rely on the msm display driver for external display connectivity. The attack surface extends to any system utilizing Qualcomm's MSM (Mobile Services Module) architecture where external display protocols such as eDP (embedded display port) are supported. Systems affected include smartphones, tablets, automotive infotainment units, and IoT devices that depend on the Linux kernel's graphics subsystem for display management. The potential impact includes system crashes, denial of service conditions, and in some scenarios could provide attackers with opportunities to escalate privileges or execute arbitrary code through carefully crafted device initialization sequences.
The remediation for this vulnerability follows standard kernel security practices by implementing proper null pointer validation before dereferencing any pointer variables. This fix aligns with the principle of defensive programming and directly addresses the Coverity static analysis finding that identified the dereference before null check pattern. The solution requires modifying the initialization sequence to ensure that all pointer validations occur before any pointer dereference operations, thereby preventing the kernel from attempting to access memory locations that have not been properly allocated or initialized. This approach conforms to the ATT&CK framework's mitigation strategies for kernel-level vulnerabilities, specifically targeting the privilege escalation and system stability categories where such flaws can be exploited to compromise system integrity. Organizations should prioritize applying this patch as it resolves a fundamental memory safety issue that could be leveraged by attackers to disrupt system operations or gain unauthorized access to critical display subsystem resources.