CVE-2021-47267

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: fix various gadget panics on 10gbps cabling

usb_assign_descriptors() is called with 5 parameters,

the last 4 of which are the usb_descriptor_header for:

full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),

high-speed (USB2.0 - 480Mbps),

super-speed (USB3.0 - 5Gbps),

super-speed-plus (USB3.1 - 10Gbps).

The differences between full/high/super-speed descriptors are usually

substantial (due to changes in the maximum usb block size from 64 to 512

to 1024 bytes and other differences in the specs), while the difference

between 5 and 10Gbps descriptors may be as little as nothing

(in many cases the same tuning is simply good enough).

However if a gadget driver calls usb_assign_descriptors() with

a NULL descriptor for super-speed-plus and is then used on a max 10gbps

configuration, the kernel will crash with a null pointer dereference,

when a 10gbps capable device port + cable + host port combina

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References