CVE-2021-47269 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: ep0: fix NULL pointer exception
There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing.
By adding this validation from the patch we can actually report a wrong index back to the caller.
In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation.
[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
[ 82.966891] Mem abort info:
[ 82.969663] ESR = 0x96000006
[ 82.972703] Exception class = DABT (current EL), IL = 32 bits
[ 82.978603] SET = 0, FnV = 0
[ 82.981642] EA = 0, S1PTW = 0
[ 82.984765] Data abort info:
[ 82.987631] ISV = 0, ISS = 0x00000006
[ 82.991449] CM = 0, WnR = 0
[ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
[ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
[ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
[ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
[ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
[ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
[ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
...
[ 83.141788] Call trace:
[ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c
[ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94
[ 83.181546] ---[ end trace aac6b5267d84c32f ]---
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2025
The vulnerability CVE-2021-47269 represents a critical NULL pointer dereference flaw within the Linux kernel's USB Device Controller driver, specifically affecting the DesignWare USB 3.0 Controller (dwc3) implementation. This issue manifests in the ep0 endpoint handling mechanism where the function dwc3_wIndex_to_dep() lacks proper validation of the endpoint index parameter. The flaw occurs when the kernel processes USB control requests that reference endpoint indices beyond the actual hardware configuration, leading to a kernel panic through a NULL pointer exception at virtual address 0x00000000000000a4. The error trace indicates the failure occurs in the dwc3_ep0_handle_feature function, which is part of the USB control endpoint 0 interrupt handling routine, demonstrating a classic buffer over-read condition that can be exploited to crash the entire system.
The technical exploitation of this vulnerability stems from insufficient bounds checking in the USB device controller driver's endpoint management logic. When a composite USB device configuration is used with fewer endpoints than indicated by the control request parameters, the dwc3_wIndex_to_dep() function returns a NULL pointer reference instead of properly validating the index against the actual hardware endpoint capabilities. This condition violates the fundamental principle of input validation and can be classified under CWE-476 as NULL Pointer Dereference, which is a common vector for kernel-level denial of service attacks. The specific error occurs during the USB feature request handling process, where the kernel attempts to access a NULL endpoint structure, resulting in an immediate system crash and potential data loss.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise the stability of embedded systems and devices relying on USB connectivity. In environments where USB devices are frequently connected and disconnected, or where composite device configurations are common, this vulnerability can lead to repeated kernel panics that effectively render the device unusable until a reboot occurs. The issue affects kernel versions including 4.19.124 and demonstrates the importance of proper input validation in kernel space drivers, as highlighted by ATT&CK technique T1499.001 for Network Denial of Service. The vulnerability is particularly concerning for embedded systems and IoT devices where automated reboot cycles could be exploited to maintain persistent availability disruption.
Mitigation strategies for CVE-2021-47269 involve implementing proper input validation in the dwc3 driver's endpoint index handling mechanism. The fix requires adding bounds checking to ensure that the index returned by dwc3_wIndex_to_dep() corresponds to actual hardware endpoint capabilities before attempting to access endpoint structures. System administrators should prioritize applying the upstream kernel patches that address this specific NULL pointer dereference issue, as the vulnerability affects all versions of the Linux kernel that implement the dwc3 USB controller driver. Additionally, monitoring for kernel oops messages and system crashes related to USB endpoint handling can help identify systems vulnerable to this issue. The fix aligns with security best practices outlined in the Linux Kernel Security documentation and represents a standard defensive programming approach to prevent buffer over-read conditions in kernel modules. Organizations should also consider implementing USB device whitelisting policies to reduce exposure while patches are deployed, particularly in critical infrastructure environments where continuous availability is paramount.