CVE-2021-47142

What it actually does

Use-after-free in the amdgpu TTM backend when sg pointer is not cleared to NULL before destruction, allowing a subsequent sg_free_table call to operate on freed memory and trigger a general protection fault.

Why it matters to the business

Systems using AMD GPUs may experience sudden kernel panics during memory management operations, causing downtime, loss of GPU-accelerated workloads, and potential data corruption in graphics or compute environments.

How an attack unfolds

An attacker with local access triggers the allocation and release path in amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu that leaves a dangling sg reference; subsequent unbind and destroy operations dereference the freed structure, crashing the kernel.

How to fix it

Update to the corrected kernel version that ensures ttm->sg is set to NULL after use; apply the AlmaLinux package updates listed for affected httpd-related modules if they ship the patched kernel, or rebuild from the fixed upstream commit.

How to confirm the fix worked

Confirm the amdgpu driver no longer panics under the original allocation/free sequence; verify the sg pointer is explicitly nulled in the backend unbind code path via source inspection or runtime tracing.

Typical attack path

1. Obtain local code execution on a system with amdgpu driver loaded
2. Invoke KFD ioctl to allocate GPU memory triggering the vulnerable TTM path
3. Force repeated allocation/release cycles to hit the use-after-free condition
4. Observe or induce kernel panic via the resulting non-canonical address fault

How to detect it

Review kernel logs for general protection faults with stack traces containing sg_free_table, amdgpu_ttm_backend_unbind, and amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu; correlate with recent KFD ioctl activity.

• general protection fault.*sg_free_table
• amdgpu_ttm_backend_unbind.cold
• amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within the next patch cycle
• Monitor for unexplained general protection faults referencing sg_free_table or amdgpu_ttm_backend_unbind
• Restrict unprivileged local access on multi-user systems until patched