CVE-2021-47269

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: ep0: fix NULL pointer exception

There is no validation of the index from dwc3_wIndex_to_dep() and we might

be referring a non-existing ep and trigger a NULL pointer exception. In

certain configurations we might use fewer eps and the index might wrongly

indicate a larger ep index than existing.

By adding this validation from the patch we can actually report a wrong

index back to the caller.

In our usecase we are using a composite device on an older kernel, but

upstream might use this fix also. Unfortunately, I cannot describe the

hardware for others to reproduce the issue as it is a proprietary

implementation.

[ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4

[ 82.966891] Mem abort info:

[ 82.969663] ESR = 0x96000006

[ 82.972703] Exception class = DABT (current EL), IL = 32 bits

[ 82.978603] SET = 0, FnV = 0

[ 82.981642] EA = 0, S1PTW =

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References