UBUNTU-CVE-2021-47269: Null Pointer Dereference

Q: Which systems are realistically exposed to this issue?

Systems using the affected Ubuntu Linux kernel packages are potentially exposed when they use the DWC3 USB controller in a configuration with fewer endpoints than an incoming endpoint index indicates. The reported use case involved a composite USB device on an older kernel and proprietary hardware configuration.

Q: What does an attacker or triggering device need to do?

The triggering condition is an invalid endpoint index returned through dwc3_wIndex_to_dep() that refers to an endpoint that does not exist. This can cause the kernel to dereference a NULL endpoint pointer and crash.

Q: What is the expected impact if the issue is triggered?

The provided report shows a kernel NULL-pointer dereference, resulting in a kernel exception. The available information supports a denial-of-service impact through a kernel crash; it does not establish confidentiality or integrity impact.

Q: How can I tell whether a system has encountered this vulnerability?

Look for kernel logs reporting an inability to handle a kernel NULL-pointer dereference in the DWC3 endpoint-zero path, potentially with an invalid endpoint index. The example report includes a dereference at virtual address 0x00000000000000a4.

Published May 21, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3wIndextodep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing. By adding this validation from the patch we can actually report a wrong index back to the caller. In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation. [ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3ep0handlefeature+0x414/0x43c [ 83.054558] lr : dwc3ep0interrupt+0x3b4/0xc94 ... [ 83.141788] Call trace: [ 83.144227] dwc3ep0handlefeature+0x414/0x43c [ 83.148823] dwc3ep0interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]---

Affected Software

118 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1123.136~14.04.1

4.15.0-1123.136~14.04.1

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1150.156

4.4.0-1150.156

ubuntu/linux-lts-xenial<4.4.0-276.310~14.04.1

4.4.0-276.310~14.04.1

ubuntu/linux<4.4.0-276.310

4.4.0-276.310

ubuntu/linux-aws<4.4.0-1188.203

4.4.0-1188.203

ubuntu/linux-aws-hwe<4.15.0-1111.118~16.04.1

4.15.0-1111.118~16.04.1

ubuntu/linux-azure<4.15.0-1123.136~16.04.1

4.15.0-1123.136~16.04.1

ubuntu/linux-gcp<4.15.0-1108.122~16.04.1

4.15.0-1108.122~16.04.1

ubuntu/linux-hwe<4.15.0-156.163~16.04.1

4.15.0-156.163~16.04.1

ubuntu/linux-kvm<4.4.0-1151.162

4.4.0-1151.162

ubuntu/linux-oracle<4.15.0-1080.88~16.04.1

4.15.0-1080.88~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1120.127

4.4.0-1120.127

ubuntu/linux-fips*

ubuntu/linux<4.15.0-156.163

4.15.0-156.163

ubuntu/linux-aws<4.15.0-1111.118

4.15.0-1111.118

ubuntu/linux-aws-5.4<5.4.0-1055.58~18.04.1

5.4.0-1055.58~18.04.1

ubuntu/linux-azure-4.15<4.15.0-1123.136

4.15.0-1123.136

ubuntu/linux-azure-5.4<5.4.0-1056.58~18.04.1

5.4.0-1056.58~18.04.1

ubuntu/linux-gcp-4.15<4.15.0-1108.122

4.15.0-1108.122

ubuntu/linux-gcp-5.4<5.4.0-1051.55~18.04.1

5.4.0-1051.55~18.04.1

ubuntu/linux-hwe-5.4<5.4.0-81.91~18.04.1

5.4.0-81.91~18.04.1

ubuntu/linux-kvm<4.15.0-1099.101

4.15.0-1099.101

ubuntu/linux-oracle<4.15.0-1080.88

4.15.0-1080.88

ubuntu/linux-oracle-5.4<5.4.0-1053.57~18.04.1

5.4.0-1053.57~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1042.46~18.04.3

5.4.0-1042.46~18.04.3

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-fips<4.15.0-2053.55

4.15.0-2053.55

ubuntu/linux-azure-fips<4.15.0-2035.39

4.15.0-2035.39

ubuntu/linux-fips<4.15.0-1069.78

4.15.0-1069.78

ubuntu/linux-gcp-fips<4.15.0-2018.20

4.15.0-2018.20

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-81.91

5.4.0-81.91

ubuntu/linux-aws<5.4.0-1055.58

5.4.0-1055.58

ubuntu/linux-azure<5.4.0-1056.58

5.4.0-1056.58

ubuntu/linux-bluefield<5.4.0-1019.22

5.4.0-1019.22

ubuntu/linux-gcp<5.4.0-1051.55

5.4.0-1051.55

ubuntu/linux-gkeop<5.4.0-1022.23

5.4.0-1022.23

ubuntu/linux-kvm<5.4.0-1045.47

5.4.0-1045.47

ubuntu/linux-oracle<5.4.0-1053.57

5.4.0-1053.57

ubuntu/linux-raspi<5.4.0-1042.46

5.4.0-1042.46

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1069.73+fips2

5.4.0-1069.73+fips2

ubuntu/linux-azure-fips<5.4.0-1073.76+fips1

5.4.0-1073.76+fips1

ubuntu/linux-fips<5.4.0-1032.37

5.4.0-1032.37

ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1

5.4.0-1067.71~20.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136~14.04.1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1150.156
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-276.310~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-276.310
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1188.203
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1111.118~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.122~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-156.163~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1151.162
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1080.88~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1120.127
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-156.163
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1111.118
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1055.58~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1123.136
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.58~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1108.122
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.55~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-81.91~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1099.101
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1080.88
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.57~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1042.46~18.04.3
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2053.55
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2035.39
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1069.78
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2018.20
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-81.91
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1055.58
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.58
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1019.22
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1051.55
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1022.23
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1045.47
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.57
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1042.46
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1069.73+fips2
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1073.76+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1032.37
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71~20.04.1

Event History

May 21, 2024

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Systems using the affected Ubuntu Linux kernel packages are potentially exposed when they use the DWC3 USB controller in a configuration with fewer endpoints than an incoming endpoint index indicates. The reported use case involved a composite USB device on an older kernel and proprietary hardware configuration.

What does an attacker or triggering device need to do?

The triggering condition is an invalid endpoint index returned through dwc3_wIndex_to_dep() that refers to an endpoint that does not exist. This can cause the kernel to dereference a NULL endpoint pointer and crash.

What is the expected impact if the issue is triggered?

The provided report shows a kernel NULL-pointer dereference, resulting in a kernel exception. The available information supports a denial-of-service impact through a kernel crash; it does not establish confidentiality or integrity impact.

How can I tell whether a system has encountered this vulnerability?

Look for kernel logs reporting an inability to handle a kernel NULL-pointer dereference in the DWC3 endpoint-zero path, potentially with an invalid endpoint index. The example report includes a dereference at virtual address 0x00000000000000a4.

UBUNTU-CVE-2021-47269: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker or triggering device need to do?

What is the expected impact if the issue is triggered?

How can I tell whether a system has encountered this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker or triggering device need to do?

What is the expected impact if the issue is triggered?

How can I tell whether a system has encountered this vulnerability?