CVE-2021-47528

What it actually does

NULL pointer dereference in cdnsp_endpoint_init when cdnsp_ring_alloc fails to allocate a ring and the pointer is subsequently dereferenced without a check, resulting in a kernel crash.

Why it matters to the business

May cause denial of service or system instability on affected Linux systems using the CDNSP USB gadget controller, particularly in embedded or specialized hardware configurations with low overall prevalence.

How an attack unfolds

An attacker with local access triggers USB gadget endpoint initialization under conditions where ring allocation fails, causing the kernel to dereference a NULL pointer and panic.

How to fix it

Apply the upstream fix that adds an explicit check of pep->ring after cdnsp_ring_alloc; upgrade to a Linux kernel version containing commit resolving the NULL dereference in the CDNSP driver.

How to confirm the fix worked

Inspect the cdnsp_endpoint_init function in the kernel source for the added NULL check on pep->ring; verify no static analyzer warnings remain for the code path and test under memory-constrained USB gadget initialization.

Typical attack path

1. Gain local access to the target system
2. Load or interact with the CDNSP USB gadget driver under CONFIG_USB_CDNSP_GADGET
3. Force cdnsp_endpoint_init to call cdnsp_ring_alloc under memory pressure
4. Trigger dereference of the uninitialized ring pointer
5. Cause kernel panic or oops

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing cdnsp_endpoint_init or cdnsp_ring_alloc; correlate with USB gadget initialization events under memory pressure.

What your security team should do

• Prioritize kernel updates for systems exposing the CDNSP gadget driver
• Monitor for kernel oops or panics during USB gadget operations
• Review CONFIG_USB_CDNSP_GADGET usage across the fleet
• Apply the fix even if the issue is low-probability per static analysis