CVE-2021-47005

What it actually does

NULL pointer dereference in pci_epf_test_alloc_space when pci_epc_ops->get_features returns NULL, triggered during pci_epf_test_bind without prior validation, resulting in kernel panic.

Why it matters to the business

Unexpected system crashes or reboots on Linux hosts using PCI endpoint framework when platform drivers omit get_features implementation, leading to service disruption and potential data loss in affected environments.

How an attack unfolds

An attacker with local access creates a symbolic link via configfs that invokes pci_epf_bind and pci_epc_epf_link, reaching pci_epf_test_bind which dereferences the unchecked pci_epc_feature pointer and crashes the kernel.

How to fix it

Apply the upstream kernel patch adding the pci_epc_feature NULL check and -ENOTSUPP return in pci_epf_test_bind; rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Inspect kernel source for the added pointer check before accessing pci_epc_feature; boot test systems exercising configfs symlink operations on PCI endpoint test functions and confirm absence of NULL dereference oops.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Interact with configfs to issue symlinkat on PCI endpoint function
3. Trigger pci_epf_test_bind path without get_features implementation
4. Cause NULL dereference and kernel oops/panic

How to detect it

Search kernel logs and dmesg for call traces containing pci_epf_test_bind, pci_epf_bind, and the NULL dereference instruction pointer; correlate with configfs symlink activity preceding the crash.

• pci_epf_test_bind+0xf4/0x388
• pci_epf_bind+0x3c/0x80
• pci_epc_epf_link+0xa8/0xcc
• end trace a438e3c5a24f9df0
• f9400400

What your security team should do

• Patch all Linux kernels to include the NULL check fix immediately
• Audit systems exposing configfs or PCI endpoint test modules for exposure
• Monitor kernel logs for pci_epf_test_bind related crashes as interim detection