CVE-2021-47409

What it actually does

Null pointer dereference in the dwc2 USB driver due to missing validation of the return value from platform_get_resource().

Why it matters to the business

Unexpected kernel crashes or denial of service on systems using the affected driver; mosquitto package on Alpine v3.18 requires update despite low EPSS and no KEV listing.

How an attack unfolds

An attacker with local access supplies or triggers a platform device configuration that causes platform_get_resource() to return NULL, which is then dereferenced without a check, leading to a crash.

How to fix it

Upgrade mosquitto on Alpine v3.18 to version 2.0.16-r0 or later; apply the upstream kernel commit that adds the missing return-value check after platform_get_resource().

How to confirm the fix worked

Confirm the platform_get_resource() return value is tested for NULL before use; verify the installed mosquitto package version is 2.0.16-r0 or newer on Alpine v3.18.

Typical attack path

1. Identify a system running a vulnerable Linux kernel with dwc2 USB driver enabled
2. Trigger or configure a platform device whose resource lookup returns NULL
3. Cause the unchecked NULL to be dereferenced resulting in kernel panic

How to detect it

Review kernel logs for oops or panic messages mentioning dwc2 and platform_get_resource; look for recent USB device enumeration failures preceding a crash.

What your security team should do

• Apply the fixed mosquitto package 2.0.16-r0 immediately on Alpine v3.18 systems
• Audit all Linux kernels for the dwc2 null-check patch and backport if needed
• Monitor for kernel oops/panic logs related to dwc2 platform resource handling