CVE-2021-47269 (GCVE-0-2021-47269)
Vulnerability from cvelistv5
Published
2024-05-21 14:19
Modified
2025-05-04 07:07
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing. By adding this validation from the patch we can actually report a wrong index back to the caller. In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation. [ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94 ... [ 83.141788] Call trace: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4 Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749 Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19 Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528 Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16 Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4 Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749 Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19 Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528 Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16 Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc Patch
af854a3a-2127-422b-91ae-364da2661108 https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a Patch
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47269",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:39:44.902872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:11.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96b74a99d360235c24052f1d060e64ac53f43528",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "60156089f07e724e4dc8483702d5e1ede4522749",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "990dc90750772622d44ca2ea6652c521e6f67e16",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bd551e7c85939de2182010273450bfa78c3742fc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "366369b89bedd59b1425386e8d4a18a466e420e4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "470403639114895e2697c766fbe17be8d0e9b67a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "788755756dd4a6aba1de479fec20b0fa600e7f19",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d00889080ab60051627dab1d85831cd9db750e2a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/ep0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.273",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.273",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.237",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.195",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.126",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: ep0: fix NULL pointer exception\n\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\nbe referring a non-existing ep and trigger a NULL pointer exception. In\ncertain configurations we might use fewer eps and the index might wrongly\nindicate a larger ep index than existing.\n\nBy adding this validation from the patch we can actually report a wrong\nindex back to the caller.\n\nIn our usecase we are using a composite device on an older kernel, but\nupstream might use this fix also. Unfortunately, I cannot describe the\nhardware for others to reproduce the issue as it is a proprietary\nimplementation.\n\n[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\n[   82.966891] Mem abort info:\n[   82.969663]   ESR = 0x96000006\n[   82.972703]   Exception class = DABT (current EL), IL = 32 bits\n[   82.978603]   SET = 0, FnV = 0\n[   82.981642]   EA = 0, S1PTW = 0\n[   82.984765] Data abort info:\n[   82.987631]   ISV = 0, ISS = 0x00000006\n[   82.991449]   CM = 0, WnR = 0\n[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\n[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\n[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\n[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\n[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\n[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\n[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\n\n...\n\n[   83.141788] Call trace:\n[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c\n[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94\n[   83.181546] ---[ end trace aac6b5267d84c32f ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:07:35.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528"
        },
        {
          "url": "https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749"
        },
        {
          "url": "https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19"
        },
        {
          "url": "https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a"
        }
      ],
      "title": "usb: dwc3: ep0: fix NULL pointer exception",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47269",
    "datePublished": "2024-05-21T14:19:59.207Z",
    "dateReserved": "2024-05-21T13:27:52.127Z",
    "dateUpdated": "2025-05-04T07:07:35.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47269\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:15.470\",\"lastModified\":\"2024-12-24T16:33:36.863\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: ep0: fix NULL pointer exception\\n\\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\\nbe referring a non-existing ep and trigger a NULL pointer exception. In\\ncertain configurations we might use fewer eps and the index might wrongly\\nindicate a larger ep index than existing.\\n\\nBy adding this validation from the patch we can actually report a wrong\\nindex back to the caller.\\n\\nIn our usecase we are using a composite device on an older kernel, but\\nupstream might use this fix also. Unfortunately, I cannot describe the\\nhardware for others to reproduce the issue as it is a proprietary\\nimplementation.\\n\\n[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\\n[   82.966891] Mem abort info:\\n[   82.969663]   ESR = 0x96000006\\n[   82.972703]   Exception class = DABT (current EL), IL = 32 bits\\n[   82.978603]   SET = 0, FnV = 0\\n[   82.981642]   EA = 0, S1PTW = 0\\n[   82.984765] Data abort info:\\n[   82.987631]   ISV = 0, ISS = 0x00000006\\n[   82.991449]   CM = 0, WnR = 0\\n[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\\n[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\\n[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\\n[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\\n[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\\n[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\\n[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\\n[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\\n\\n...\\n\\n[   83.141788] Call trace:\\n[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c\\n[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94\\n[   83.181546] ---[ end trace aac6b5267d84c32f ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc3: ep0: corrige excepci\u00f3n de puntero NULL. No hay validaci\u00f3n del \u00edndice desde dwc3_wIndex_to_dep() y podr\u00edamos estar haciendo referencia a un ep inexistente y desencadenar una excepci\u00f3n de puntero NULL. En ciertas configuraciones, podr\u00edamos usar menos eps y el \u00edndice podr\u00eda indicar err\u00f3neamente un \u00edndice ep mayor que el existente. Al agregar esta validaci\u00f3n del parche, podemos informar un \u00edndice incorrecto a la persona que llama. En nuestro caso de uso, estamos usando un dispositivo compuesto en un kernel m\u00e1s antiguo, pero el nivel superior tambi\u00e9n podr\u00eda usar esta soluci\u00f3n. Desafortunadamente, no puedo describir el hardware para que otros reproduzcan el problema ya que es una implementaci\u00f3n propietaria. [82.958261] No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 00000000000000a4 [82.966891] Informaci\u00f3n de cancelaci\u00f3n de memoria: [82.969663] ESR = 0x96000006 [82.972703] Clase de excepci\u00f3n = DABT (EL actual), IL = 32 bits [ 82.9 78603] CONFIGURAR = 0, FnV = 0 [82.981642] EA = 0, S1PTW = 0 [82.984765] Informaci\u00f3n de cancelaci\u00f3n de datos: [82.987631] ISV = 0, ISS = 0x00000006 [82.991449] CM = 0, WnR = 0 [82.994409] tabla de usuario 4k: p\u00e1ginas, 39 VA de bits, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.00 9685] Error interno: Oops: 96000006 [#1] SMP PREEMPTO [83.026433] Proceso irq/62-dwc3 (pid : 303, l\u00edmite de pila = 0x000000003985154c) [83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 No contaminado 4.19.124 #1 [83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 49628] ordenador personal: dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94 ... [ 83.141788] Rastreo de llamadas: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148 823] dwc3_ep0_interrupt+0x3b4/0xc94 [83.181546] ---[ final de seguimiento aac6b5267d84c32f ]---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.4.273\",\"matchCriteriaId\":\"2A209A4F-1F96-4D92-BCA6-A12D00C4404B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.9.273\",\"matchCriteriaId\":\"484D222B-5082-4E28-BF0F-B52766353015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.237\",\"matchCriteriaId\":\"83CDDAD5-5539-46C9-9255-C1DAC38F7905\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.195\",\"matchCriteriaId\":\"23EECCE9-4D4C-4684-AB00-10C938F5DDC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.126\",\"matchCriteriaId\":\"876275F9-BEC7-40E8-9D7F-A20729A4A4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.44\",\"matchCriteriaId\":\"DA547B08-9D25-467B-AD0D-8460FE4EE70D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.11\",\"matchCriteriaId\":\"F914A757-FAFD-407E-9031-21F66635D5EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF351855-2437-4CF5-AD7C-BDFA51F27683\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.981Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47269\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:39:44.902872Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:15.110Z\"}}], \"cna\": {\"title\": \"usb: dwc3: ep0: fix NULL pointer exception\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"96b74a99d360\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"60156089f07e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"990dc9075077\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"bd551e7c8593\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"366369b89bed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"470403639114\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"788755756dd4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1da177e4c3f4\", \"lessThan\": \"d00889080ab6\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/dwc3/ep0.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.4.273\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.273\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.237\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.195\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.126\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.44\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/dwc3/ep0.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/96b74a99d360235c24052f1d060e64ac53f43528\"}, {\"url\": \"https://git.kernel.org/stable/c/60156089f07e724e4dc8483702d5e1ede4522749\"}, {\"url\": \"https://git.kernel.org/stable/c/990dc90750772622d44ca2ea6652c521e6f67e16\"}, {\"url\": \"https://git.kernel.org/stable/c/bd551e7c85939de2182010273450bfa78c3742fc\"}, {\"url\": \"https://git.kernel.org/stable/c/366369b89bedd59b1425386e8d4a18a466e420e4\"}, {\"url\": \"https://git.kernel.org/stable/c/470403639114895e2697c766fbe17be8d0e9b67a\"}, {\"url\": \"https://git.kernel.org/stable/c/788755756dd4a6aba1de479fec20b0fa600e7f19\"}, {\"url\": \"https://git.kernel.org/stable/c/d00889080ab60051627dab1d85831cd9db750e2a\"}], \"x_generator\": {\"engine\": \"bippy-a5840b7849dd\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: dwc3: ep0: fix NULL pointer exception\\n\\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\\nbe referring a non-existing ep and trigger a NULL pointer exception. In\\ncertain configurations we might use fewer eps and the index might wrongly\\nindicate a larger ep index than existing.\\n\\nBy adding this validation from the patch we can actually report a wrong\\nindex back to the caller.\\n\\nIn our usecase we are using a composite device on an older kernel, but\\nupstream might use this fix also. Unfortunately, I cannot describe the\\nhardware for others to reproduce the issue as it is a proprietary\\nimplementation.\\n\\n[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\\n[   82.966891] Mem abort info:\\n[   82.969663]   ESR = 0x96000006\\n[   82.972703]   Exception class = DABT (current EL), IL = 32 bits\\n[   82.978603]   SET = 0, FnV = 0\\n[   82.981642]   EA = 0, S1PTW = 0\\n[   82.984765] Data abort info:\\n[   82.987631]   ISV = 0, ISS = 0x00000006\\n[   82.991449]   CM = 0, WnR = 0\\n[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\\n[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\\n[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\\n[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\\n[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\\n[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\\n[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\\n[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\\n\\n...\\n\\n[   83.141788] Call trace:\\n[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c\\n[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94\\n[   83.181546] ---[ end trace aac6b5267d84c32f ]---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-05-29T05:05:00.544Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47269\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-11T17:33:11.229Z\", \"dateReserved\": \"2024-05-21T13:27:52.127Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:59.207Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.