CVE-2021-47273

What it actually does

Uninitialized regmap entry for PHY1 during USB2 PHY glue initialization when PHY0 is disabled leads to NULL pointer dereference in regmap_update_bits_base during dwc3_meson_g12a_usb2_init_phy.

Why it matters to the business

Kernel crashes on specific embedded hardware configurations using only PHY1, causing system instability and potential downtime on affected devices with no known active exploitation.

How an attack unfolds

An attacker with local access or control over boot conditions on vulnerable hardware triggers USB controller probe with PHY0 disabled, leading to the uninitialized regmap access and kernel NULL dereference during initialization.

How to fix it

Update to a Linux kernel version containing the fix for the regmap initialization logic in dwc3-meson-g12a; ensure PHY1 regmap entry is always initialized regardless of PHY0 state.

How to confirm the fix worked

Confirm kernel version includes the commit resolving the PHY1 regmap initialization; test boot and USB initialization on affected hardware with PHY0 disabled to verify absence of NULL dereference.

Typical attack path

1. Identify or configure target system using dwc3-meson-g12a with only PHY1 enabled
2. Trigger USB initialization or device probe
3. Cause regmap_update_bits_base to dereference uninitialized PHY1 entry
4. Achieve kernel NULL pointer dereference crash

How to detect it

Review kernel logs for regmap_update_bits_base and dwc3_meson_g12a_usb2_init_phy call traces indicating NULL pointer dereference during probe; check for crashes on systems with PHY0 disabled.

What your security team should do

• Prioritize kernel updates on embedded devices using dwc3-meson-g12a USB controllers
• Monitor for kernel oops or NULL dereference logs during USB probe on Odroid-HC4 and similar boards
• Apply the fix promptly even with low EPSS as it addresses a stability and potential memory corruption issue