CVE-2021-20292

What it actually does

Use-after-free in the Nouveau DRM driver caused by missing validation of a TTM object prior to operations on it, allowing kernel memory corruption.

Why it matters to the business

A local attacker with root privileges can gain arbitrary code execution inside the kernel, leading to full host compromise, persistence, and lateral movement on affected Linux systems.

How an attack unfolds

An attacker with an existing local root account crafts input that triggers the Nouveau SGDMA path without a valid object, reuses the freed memory, and executes arbitrary kernel code to elevate from root user to full kernel control.

How to fix it

Upgrade the Linux kernel to version 5.9 or later. Apply distribution-specific backports for supported releases of Fedora, RHEL, and Debian. Disable the Nouveau driver if the hardware is not required.

How to confirm the fix worked

Verify kernel version is 5.9 or newer; confirm the vulnerable nouveau_sgdma.c code path is absent or patched; run kernel regression tests that exercise DRM TTM allocation paths.

Typical attack path

1. Obtain local root shell on target system
2. Trigger nouveau_sgdma_create_ttm with invalid object state
3. Trigger use-after-free and corrupt kernel structures
4. Execute kernel payload for privilege escalation or persistence

How to detect it

Review kernel logs for Nouveau SGDMA errors or crashes around the time of suspicious local activity; inspect audit logs for unexpected use of DRM ioctls by root processes; correlate with any kernel oops or panic entries referencing nouveau.

What your security team should do

• Patch all affected systems to kernel 5.9+ immediately
• Restrict local root access via least-privilege policies
• Monitor for anomalous Nouveau driver activity in system logs
• Consider blacklisting Nouveau on systems without NVIDIA hardware