CVE-2021-47601

What it actually does

The amdtee driver incorrectly used IS_ERR() on the return value of __get_free_pages(), which returns NULL on failure rather than an error pointer, allowing a subsequent dereference of a NULL address.

Why it matters to the business

On AMD platforms using the TEE subsystem, memory-pressure conditions can trigger kernel instability or crashes; the issue has remained unexploited in the wild for over two years with negligible exploitation probability.

How an attack unfolds

An attacker would need to induce memory exhaustion so that __get_free_pages() returns NULL inside amdtee, after which the erroneous IS_ERR() check permits continued execution that dereferences the NULL pointer, resulting in a kernel fault.

How to fix it

Upgrade the Linux kernel to a version containing the amdtee IS_ERR-vs-NULL correction; apply the fix from the 2024-06-19 stable updates onward.

How to confirm the fix worked

Inspect the amdtee source for replacement of IS_ERR() with a direct NULL check on the __get_free_pages() result and confirm the change is present in the running kernel tree.

Typical attack path

1. Force memory pressure on the target system
2. Trigger amdtee code paths that allocate pages
3. Cause the allocation to fail and return NULL
4. Rely on the incorrect IS_ERR() check to proceed with the NULL value
5. Trigger NULL pointer dereference and kernel panic

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing amdtee combined with get_free_pages or page allocation failures around the time of the dereference.

What your security team should do

• Prioritize kernel updates on AMD systems that load amdtee
• Review kernel configuration to determine whether amdtee is compiled in or loadable
• Monitor EPSS and KEV status for any future change in risk