CVE-2021-47413

What it actually does

NULL pointer dereference in the chipidea USB driver when the USB PHY is specified via the 'phys' devicetree phandle instead of 'fsl,usbphy', leaving data->usb_phy unpopulated while charger detection code dereferences it.

Why it matters to the business

Kernel panic during USB initialization on affected i.MX7/i.MX8MM systems can cause boot failure or loss of USB functionality, affecting embedded devices that rely on this driver; low overall urgency given absence from known exploited lists and minimal exploitation probability.

How an attack unfolds

An attacker with the ability to load or modify a device tree on a vulnerable kernel boots or probes the USB subsystem, triggering imx7d_charger_detection which follows the unpopulated pointer path and crashes the kernel; no remote vector or known threat actor usage.

How to fix it

Apply the upstream fix that also searches for the 'phys' phandle when 'fsl,usbphy' is absent; update to a Linux kernel containing commit 6e3e3d3f or later mainline releases after 5.14 that include this change.

How to confirm the fix worked

Confirm the presence of the 'phys' search logic in ci_hdrc_imx.c and verify that boards using the recommended devicetree binding no longer trigger the NULL dereference on probe.

Typical attack path

1. Supply a devicetree using the 'phys' property for the USB controller
2. Boot or dynamically probe the ci_hdrc_imx driver on i.MX7 or i.MX8MM hardware
3. imx7d_charger_detection executes and dereferences the NULL usb_phy pointer
4. Kernel oops and panic occur

How to detect it

Inspect kernel logs for the exact oops string 'Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098' combined with the imx7d_charger_detection symbol during deferred_probe_work_func; review boot logs on affected hardware for charger detection failures.

What your security team should do

• Prioritize patching on i.MX7 and i.MX8MM devices that use the chipidea USB driver
• Audit device trees for 'phys' usage and ensure they match the fixed driver
• Monitor kernel logs for imx7d_charger_detection oops signatures during USB bring-up