| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: fix kernel panic when do reboot\n\nWhen do system reboot, it calls dwc3_shutdown and the whole debugfs\nfor dwc3 has removed first, when the gadget tries to do deinit, and\nremove debugfs for its endpoints, it meets NULL pointer dereference\nissue when call debugfs_lookup. Fix it by removing the whole dwc3\ndebugfs later than dwc3_drd_exit.\n\n[ 2924.958838] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000002\n....\n[ 2925.030994] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)\n[ 2925.037005] pc : inode_permission+0x2c/0x198\n[ 2925.041281] lr : lookup_one_len_common+0xb0/0xf8\n[ 2925.045903] sp : ffff80001276ba70\n[ 2925.049218] x29: ffff80001276ba70 x28: ffff0000c01f0000 x27: 0000000000000000\n[ 2925.056364] x26: ffff800011791e70 x25: 0000000000000008 x24: dead000000000100\n[ 2925.063510] x23: dead000000000122 x22: 0000000000000000 x21: 0000000000000001\n[ 2925.070652] x20: ffff8000122c6188 x19: 0000000000000000 x18: 0000000000000000\n[ 2925.077797] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000004\n[ 2925.084943] x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000030\n[ 2925.092087] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f x9 : ffff8000102b2420\n[ 2925.099232] x8 : 7f7f7f7f7f7f7f7f x7 : feff73746e2f6f64 x6 : 0000000000008080\n[ 2925.106378] x5 : 61c8864680b583eb x4 : 209e6ec2d263dbb7 x3 : 000074756f307065\n[ 2925.113523] x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff8000122c6188\n[ 2925.120671] Call trace:\n[ 2925.123119] inode_permission+0x2c/0x198\n[ 2925.127042] lookup_one_len_common+0xb0/0xf8\n[ 2925.131315] lookup_one_len_unlocked+0x34/0xb0\n[ 2925.135764] lookup_positive_unlocked+0x14/0x50\n[ 2925.140296] debugfs_lookup+0x68/0xa0\n[ 2925.143964] dwc3_gadget_free_endpoints+0x84/0xb0\n[ 2925.148675] dwc3_gadget_exit+0x28/0x78\n[ 2925.152518] dwc3_drd_exit+0x100/0x1f8\n[ 2925.156267] dwc3_remove+0x11c/0x120\n[ 2925.159851] dwc3_shutdown+0x14/0x20\n[ 2925.163432] platform_shutdown+0x28/0x38\n[ 2925.167360] device_shutdown+0x15c/0x378\n[ 2925.171291] kernel_restart_prepare+0x3c/0x48\n[ 2925.175650] kernel_restart+0x1c/0x68\n[ 2925.179316] __do_sys_reboot+0x218/0x240\n[ 2925.183247] __arm64_sys_reboot+0x28/0x30\n[ 2925.187262] invoke_syscall+0x48/0x100\n[ 2925.191017] el0_svc_common.constprop.0+0x48/0xc8\n[ 2925.195726] do_el0_svc+0x28/0x88\n[ 2925.199045] el0_svc+0x20/0x30\n[ 2925.202104] el0_sync_handler+0xa8/0xb0\n[ 2925.205942] el0_sync+0x148/0x180\n[ 2925.209270] Code: a9025bf5 2a0203f5 121f0056 370802b5 (79400660)\n[ 2925.215372] ---[ end trace 124254d8e485a58b ]---\n[ 2925.220012] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n[ 2925.227676] Kernel Offset: disabled\n[ 2925.231164] CPU features: 0x00001001,20000846\n[ 2925.235521] Memory Limit: none\n[ 2925.238580] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---" |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/usb/dwc3/core.c" |
| ], |
| "versions": [ |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "ff4c63f3e8cb", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "58b5e02c6ca0", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "7f9745ab342b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "fd7c4bd58249", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "174c27583b38", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "fa8c413e6b74", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "5ff90af9da8f", |
| "lessThan": "2a042767814b", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/usb/dwc3/core.c" |
| ], |
| "versions": [ |
| { |
| "version": "5.14", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "5.14", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.9.274", |
| "lessThanOrEqual": "4.9.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.14.238", |
| "lessThanOrEqual": "4.14.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "4.19.196", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.4.128", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.10.46", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| }, |
| { |
| "version": "5.12.13", |
| "lessThanOrEqual": "5.12.*", |
| "status": "unaffected", |
| "versionType": "custom" |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/ff4c63f3e8cb7af2ce51cc56b031e08fd23c758b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/58b5e02c6ca0e2b7c87cd8023ff786ef3c0eef74" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/7f9745ab342bcce5efd5d4d2297d0a3dd9db0eac" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/fd7c4bd582494934be15d41aebe0dbe23790605f" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/174c27583b3807ac96228c442735b02622d8d1c3" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/fa8c413e6b74ae5d12daf911c73238c5bdacd8e6" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/2a042767814bd0edf2619f06fecd374e266ea068" |
| } |
| ], |
| "title": "usb: dwc3: core: fix kernel panic when do reboot", |
| "x_generator": { |
| "engine": "bippy-c9c4e1df01b2" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2021-47220", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
