Review reviewHigh

CVE-2021-47087

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix incorrect page free bug Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this pointer as we would free any arbitrary pages. Fix this by stop modifying the page pointer.

CVSS: 7.8
EPSS: 0.23%
CISA KEV: Not listed
Published: 2024.03.05

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.23%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 3c712f14d8a9354a8807c15c64c8dd334499cc42 < 806142c805cacd098e61bdc0f72c778a2389fe4a, >= 1340dc3fb75ea69221f4f5dcb0cbace55ad0331c < ad338d825e3f7b96ee542bf313728af2d19fe9ad, >= ec185dd3ab257dc2a60953fdf1b6622f524cc5b7 < 91e94e42f6fc49635f1a16d8ae3f79552bcfda29, >= ec185dd3ab257dc2a60953fdf1b6622f524cc5b7 < 18549bf4b21c739a9def39f27dcac53e27286ab5, >= 255e17923b22cb7abd026e044416d61f6bd0eec0, >= 5.4.140 < 5.4.169, >= 5.10.58 < 5.10.89, >= 5.13.10 < 5.14, >= 5.14, >= 5.14 < 5.15.12, 5.16
Fixed versions: 5.4.169, 5.10.89, 5.15.12

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-763