CVE-2021-47436
📋 TL;DR
This CVE describes a kernel crash vulnerability in the Linux kernel's USB MUSB driver for DSPS platforms. When the probe function fails during device initialization, it doesn't properly clean up platform device resources, leading to potential NULL pointer dereferences and system crashes. This affects Linux systems using the affected MUSB driver, particularly on BeagleBone Black Wireless devices.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic and system crash leading to denial of service, potentially causing data loss or system instability.
Likely Case
System crash during boot or USB device initialization, requiring reboot to recover.
If Mitigated
No impact if patched or if the specific error condition doesn't occur.
🎯 Exploit Status
Exploitation requires triggering specific error conditions during USB device initialization, making it difficult to weaponize for remote attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in kernel commits referenced in CVE description
Vendor Advisory: https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing fix commits
2. Rebuild kernel if using custom kernel
3. Reboot system to load patched kernel
🔧 Temporary Workarounds
Disable affected USB functionality
linuxDisable the MUSB DSPS driver or USB gadget functionality if not needed
echo 'blacklist musb_dsps' >> /etc/modprobe.d/blacklist.conf
modprobe -r musb_dsps
🧯 If You Can't Patch
- Avoid using USB Ethernet gadget functionality on affected hardware
- Monitor system logs for USB initialization errors and reboot if crashes occur
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if musb_dsps module is loaded: 'uname -r' and 'lsmod | grep musb_dsps'Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated beyond affected versions and check dmesg for USB initialization errors📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- NULL pointer dereference in USB/MUSB driver
- USB device initialization failures
Network Indicators:
- None - this is a local kernel issue
SIEM Query:
Search for kernel panic events or USB driver errors in system logs🔗 References
- https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c
- https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e
- https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb
- https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801
- https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676
- https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc
- https://git.kernel.org/stable/c/5ed60a430fb5f3d93e7fef66264daef466b4d10c
- https://git.kernel.org/stable/c/9ab5d539bc975b8dcde86eca1b58d836b657732e
- https://git.kernel.org/stable/c/9d89e287116796bf987cc48f5c8632ef3048f8eb
- https://git.kernel.org/stable/c/c2115b2b16421d93d4993f3fe4c520e91d6fe801
- https://git.kernel.org/stable/c/e923bce31ffefe4f60edfc6b84f62d4a858f3676
- https://git.kernel.org/stable/c/ff9249aab39820be11b6975a10d94253b7d426fc
