CVE-2021-47269

What it actually does

Missing bounds check on endpoint index returned by dwc3_wIndex_to_dep allows a NULL pointer dereference in dwc3_ep0_handle_feature when a USB control request references a non-existent endpoint.

Why it matters to the business

Systems using the dwc3 USB controller in composite device configurations can experience kernel crashes that interrupt USB functionality and require reboots, affecting device availability.

How an attack unfolds

An attacker crafts a USB control transfer containing an invalid wIndex value that exceeds the number of configured endpoints; the kernel passes this index without validation, causing dwc3_ep0_handle_feature to dereference a NULL endpoint structure and trigger a kernel oops.

How to fix it

Apply the upstream patch that adds validation in dwc3_ep0_handle_feature to reject invalid indices and return an error to the caller; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the fix by inspecting the dwc3 source for the added index range check before dereferencing the endpoint; test with crafted control requests to ensure no NULL dereference occurs and a proper error is returned.

Typical attack path

1. Attach to dwc3-based USB device or emulate one in composite mode
2. Send SETUP packet with feature request using out-of-range wIndex
3. Kernel calls dwc3_wIndex_to_dep returning NULL
4. NULL dereference occurs in dwc3_ep0_handle_feature
5. Kernel panics or oopses, crashing the irq handler

How to detect it

Search kernel logs for oops traces containing dwc3_ep0_handle_feature and NULL pointer dereference at addresses near dwc3 endpoint structures; correlate with USB device attach events.

What your security team should do

• Prioritize patching any kernel using dwc3 in USB gadget or composite configurations
• Monitor kernel logs for dwc3 NULL pointer oops signatures during USB enumeration
• Limit exposure by disabling unnecessary USB gadget features until patched