UBUNTU-CVE-2021-47211: Null Pointer Dereference

Q: Which Ubuntu kernel packages are affected?

The affected software list includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, and the AWS, Azure, and GCP FIPS kernel variants.

Q: What is the impact if this issue is triggered?

The issue can cause a null pointer dereference in the ALSA USB-audio code when the cs_desc pointer returned by snd_usb_find_clock_source is null. The listed impact is limited to availability, indicating a potential denial of service.

Q: What condition leads to the vulnerable code path?

The vulnerable path occurs when snd_usb_find_clock_source returns a null cs_desc pointer and the USB-audio code dereferences it without first checking for null.

Published Apr 10, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix null pointer dereference on pointer csdesc The pointer csdesc return from sndusbfindclocksource could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference.

Affected Software

122 affected componentsFixes available

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1144.150

4.4.0-1144.150

ubuntu/linux-azure<4.15.0-1189.204~14.04.1

4.15.0-1189.204~14.04.1

ubuntu/linux-lts-xenial<4.4.0-269.303~14.04.1

4.4.0-269.303~14.04.1

ubuntu/linux<4.4.0-269.303

4.4.0-269.303

ubuntu/linux-aws<4.4.0-1182.197

4.4.0-1182.197

ubuntu/linux-aws-hwe<4.15.0-1181.194~16.04.1

4.15.0-1181.194~16.04.1

ubuntu/linux-azure<4.15.0-1189.204~16.04.1

4.15.0-1189.204~16.04.1

ubuntu/linux-gcp<4.15.0-1174.191~16.04.1

4.15.0-1174.191~16.04.1

ubuntu/linux-hwe<4.15.0-238.250~16.04.1

4.15.0-238.250~16.04.1

ubuntu/linux-kvm<4.4.0-1145.156

4.4.0-1145.156

ubuntu/linux-oracle<4.15.0-1143.154~16.04.1

4.15.0-1143.154~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1114.121

4.4.0-1114.121

ubuntu/linux-fips*

ubuntu/linux<4.15.0-238.250

4.15.0-238.250

ubuntu/linux-aws<4.15.0-1181.194

4.15.0-1181.194

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1147.157~18.04.1

5.4.0-1147.157~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1189.204

4.15.0-1189.204

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1152.159~18.04.1

5.4.0-1152.159~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1174.191

4.15.0-1174.191

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1150.159~18.04.1

5.4.0-1150.159~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-218.238~18.04.1

5.4.0-218.238~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1093.98~18.04.1

5.4.0-1093.98~18.04.1

ubuntu/linux-kvm<4.15.0-1164.169

4.15.0-1164.169

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1143.154

4.15.0-1143.154

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1145.155~18.04.1

5.4.0-1145.155~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1130.143~18.04.1

5.4.0-1130.143~18.04.1

ubuntu/linux-aws-fips<4.15.0-2119.125

4.15.0-2119.125

ubuntu/linux-azure-fips<4.15.0-2098.104

4.15.0-2098.104

ubuntu/linux-fips<4.15.0-1136.147

4.15.0-1136.147

ubuntu/linux-gcp-fips<4.15.0-2082.88

4.15.0-2082.88

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-218.238

5.4.0-218.238

ubuntu/linux-aws<5.4.0-1147.157

5.4.0-1147.157

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1152.159

5.4.0-1152.159

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1106.113

5.4.0-1106.113

ubuntu/linux-gcp<5.4.0-1150.159

5.4.0-1150.159

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1093.98

5.4.0-1093.98

ubuntu/linux-intel-5.13*

ubuntu/linux-iot<5.4.0-1051.54

5.4.0-1051.54

ubuntu/linux-kvm<5.4.0-1134.143

5.4.0-1134.143

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1145.155

5.4.0-1145.155

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1130.143

5.4.0-1130.143

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1065.69

5.4.0-1065.69

ubuntu/linux-aws-fips<5.4.0-1147.157+fips1

5.4.0-1147.157+fips1

ubuntu/linux-azure-fips<5.4.0-1153.160+fips1

5.4.0-1153.160+fips1

ubuntu/linux-fips<5.4.0-1121.131

5.4.0-1121.131

ubuntu/linux-gcp-fips<5.4.0-1150.159+fips1

5.4.0-1150.159+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1144.150
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1189.204~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-269.303~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-269.303
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1182.197
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1181.194~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1189.204~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1174.191~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-238.250~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1145.156
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1143.154~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1114.121
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-238.250
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1181.194
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1147.157~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1189.204
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.159~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1174.191
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1150.159~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-218.238~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1093.98~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1164.169
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1143.154
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1145.155~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1130.143~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2119.125
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2098.104
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1136.147
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2082.88
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-218.238
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1147.157
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.159
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1106.113
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1150.159
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1093.98
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.54
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1134.143
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1145.155
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1130.143
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1065.69
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1147.157+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1153.160+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1121.131
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1150.159+fips1
Compensating control
Add a null check for the cs_desc pointer returned by snd_usb_find_clock_source before dereferencing it.

Event History

Apr 10, 2024

CVE Published

via OSV·07:15 PM

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are affected?

The affected software list includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, and the AWS, Azure, and GCP FIPS kernel variants.

What is the impact if this issue is triggered?

The issue can cause a null pointer dereference in the ALSA USB-audio code when the cs_desc pointer returned by snd_usb_find_clock_source is null. The listed impact is limited to availability, indicating a potential denial of service.

What condition leads to the vulnerable code path?

The vulnerable path occurs when snd_usb_find_clock_source returns a null cs_desc pointer and the USB-audio code dereferences it without first checking for null.

UBUNTU-CVE-2021-47211: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are affected?

What is the impact if this issue is triggered?

What condition leads to the vulnerable code path?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are affected?

What is the impact if this issue is triggered?

What condition leads to the vulnerable code path?