CVE-2021-47270 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
usb: fix various gadgets null ptr deref on 10gbps cabling.
This avoids a null pointer dereference in f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}
by simply reusing the 5gbps config for 10gbps.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2025
The vulnerability identified as CVE-2021-47270 represents a critical null pointer dereference issue within the Linux kernel's USB gadget subsystem. This flaw specifically affects the handling of USB 10 gigabits per second cabling configurations and impacts multiple USB gadget drivers including ecm, eem, hid, loopback, printer, rndis, serial, sourcesink, subset, and tcm. The vulnerability stems from inadequate handling of high-speed USB connections where the kernel fails to properly validate pointer references when transitioning between different USB speed configurations. This issue creates a potential denial of service condition that could be exploited by malicious actors to disrupt system operations.
The technical root cause of this vulnerability lies in the kernel's USB gadget framework where it attempts to manage USB 10gbps connections by reusing existing 5gbps configuration structures without proper validation. When a USB gadget driver encounters a 10gbps connection, it fails to properly initialize or validate necessary pointers before attempting to dereference them, leading to a kernel panic or system crash. This behavior directly corresponds to CWE-476 which defines null pointer dereference vulnerabilities, and aligns with ATT&CK technique T1499.004 related to network denial of service attacks. The flaw demonstrates poor input validation and resource management within the USB subsystem's configuration handling code.
The operational impact of CVE-2021-47270 extends beyond simple system crashes to potentially enable more sophisticated attack vectors. Systems running affected Linux kernels could experience complete service disruption when USB 10gbps connections are established, particularly in environments where USB gadget functionality is critical such as network infrastructure devices, embedded systems, or industrial control systems. Attackers could exploit this vulnerability to perform persistent denial of service attacks against target systems, making it particularly dangerous in production environments. The vulnerability affects all Linux kernel versions prior to the patch release, leaving widespread deployment surfaces exposed to potential exploitation.
Mitigation strategies for this vulnerability primarily involve applying the official kernel patches released by the Linux kernel security team, which implement proper pointer validation and configuration reuse mechanisms. System administrators should prioritize updating their kernel versions to include the fix, particularly in environments where USB 10gbps connectivity is utilized. Additional defensive measures include implementing USB port access controls, monitoring for unusual USB connection patterns, and maintaining robust system monitoring to detect potential exploitation attempts. Organizations should also consider implementing network segmentation to limit the impact of potential exploitation and establish incident response procedures specifically addressing USB-related kernel vulnerabilities. The fix addresses the underlying issue by ensuring proper configuration handling and pointer validation before any dereference operations occur, aligning with best practices for kernel security hardening and preventing similar null pointer dereference scenarios.