CVE-2021-47270 – A null pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2021-47270?

CVE-2021-47270 has a CVSS score of 5.5 (MEDIUM). A null pointer dereference vulnerability in the Linux kernel's USB gadget subsystem affects multiple USB gadget drivers when 10Gbps USB cabling is used. This can cause kernel panics or system crashes on affected systems. The vulnerability impacts Linux systems using USB gadget functionality, particularly embedded devices, IoT devices, or systems configured as USB peripherals.

📋 TL;DR

A null pointer dereference vulnerability in the Linux kernel's USB gadget subsystem affects multiple USB gadget drivers when 10Gbps USB cabling is used. This can cause kernel panics or system crashes on affected systems. The vulnerability impacts Linux systems using USB gadget functionality, particularly embedded devices, IoT devices, or systems configured as USB peripherals.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE, but vulnerability exists in versions before the fix commits.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when USB gadget subsystem is enabled and specific gadget drivers (ecm, eem, hid, loopback, printer, rndis, serial, sourcesink, subset, tcm) are used with 10Gbps USB connections.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to complete system crash and denial of service, potentially requiring physical intervention to restore functionality.

🟠

Likely Case

System crash or instability when specific USB gadget drivers are used with 10Gbps USB connections, resulting in denial of service.

🟢

If Mitigated

No impact if USB gadget functionality is disabled or if systems don't use affected USB gadget drivers with 10Gbps cabling.

🌐 Internet-Facing: LOW - This vulnerability requires physical USB connection or local access to exploit.

🏢 Internal Only: MEDIUM - Could be exploited by malicious insiders or through compromised USB devices in controlled environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires physical USB access or ability to connect USB devices to the target system. The vulnerability is triggered by specific USB gadget configurations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 10770d2ac0094b053c8897d96d7b2737cd72f7c5, 4b289a0f3033f465b4fd51ba995251a7867a2aa2, 8cd5f45c1b769e3e9e0f4325dd08b6c3749dc7ee, 90c4d05780d47e14a50e11a7f17373104cd47d25, b4903f7fdc484628d0b8022daf86e2439d3ab4db

Vendor Advisory: https://git.kernel.org/stable/c/10770d2ac0094b053c8897d96d7b2737cd72f7c5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. For custom kernels: Apply the relevant kernel patches. 4. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable USB gadget functionality

linux

Prevent exploitation by disabling USB gadget subsystem if not required.

modprobe -r g_ether g_serial g_mass_storage g_audio g_webcam g_midi g_hid g_acm_ms g_cdc g_multi g_nokia g_android g_ffs g_ncm g_phonet g_rndis g_ecm g_eem g_subset g_tcm

Blacklist affected gadget drivers

linux

Prevent loading of vulnerable USB gadget drivers.

echo 'blacklist g_ecm' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_eem' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_hid' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_printer' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_rndis' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_serial' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_sourcesink' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_subset' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist g_tcm' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

Disable USB gadget functionality entirely if not required for system operation
Implement physical security controls to prevent unauthorized USB device connections

🔍 How to Verify

Check if Vulnerable:

Check if USB gadget drivers are loaded: lsmod | grep -E 'g_ecm|g_eem|g_hid|g_printer|g_rndis|g_serial|g_sourcesink|g_subset|g_tcm'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits or verify affected gadget drivers no longer crash with 10Gbps USB connections

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
USB-related crash logs
System crash/reboot logs

Network Indicators:

None - this is a local USB-based vulnerability

SIEM Query:

source="kern.log" AND ("kernel panic" OR "Oops" OR "BUG") AND ("usb" OR "gadget")

📊 Metadata

CVE ID: CVE-2021-47270

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: May 21, 2024

Last Updated: December 24, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47270, you might also want to check these: