PT-2024-11277 · Linux+1 · Linux Kernel+1

Jack Pham · Published 2021-05-28 · Updated 2025-04-30 · CVE-2021-47272

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A possible scenario exists where dwc3 gadget init() can fail during a host to peripheral mode switch in dwc3 set mode(), and a pending gadget driver fails to bind. If the DRD undergoes another mode switch from peripheral to host, dwc3 gadget exit() will attempt to reference an invalid and dangling dwc->gadget pointer and call dma free coherent() on unmapped DMA pointers. The issue can be reproduced by starting DWC3 in peripheral mode, configuring ConfigFS gadget with FunctionFS instance, running FunctionFS userspace application, binding gadget driver to DWC3's UDC, switching to host mode, stopping FunctionFS application, switching to peripheral mode, and then back to host mode. Although userspace should ensure the FunctionFS application is ready before allowing the composite driver to bind to the UDC, failure to do so should not result in a panic from the kernel driver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-14366

CVE-2021-47272

Affected Products

Astra Linux

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47272 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14366 · Security Note
• https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8 · Patch
• https://cve.org/CVERecord?id=CVE-2021-47272 · Security Note
• https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87 · Patch
• https://ubuntu.com/security/CVE-2021-47272 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47272 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-47272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47272 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47272 · Vendor Advisory
• https://t.me/cvenotify/120318 · Telegram Post
• https://lore.kernel.org/linux-cve-announce/2024052151-CVE-2021-47272-607d@gregkh · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.44 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.11 · Note