CVE-2021-47434 xhci: Fix command ring pointer corruption while aborting a command
A race condition in the Linux kernel xHCI driver can corrupt the command ring pointer, leading to memory access failures and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47434?
CVE-2021-47434 is a medium-severity vulnerability in Linux kernel, published on 22 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xhci: Fix command ring pointer corruption while aborting a command
The command ring pointer is located at [6:63] bits of the command ring control register (CRCR). All the control bits like command stop, abort are located at [0:3] bits. While aborting a command, we read the CRCR and set the abort bit and write to the CRCR. The read will always give command ring pointer as all zeros. So we essentially write only the control bits. Since we split the 64 bit write into two 32 bit writes, there is a possibility of xHC command ring stopped before the upper dword (all zeros) is written. If that happens, xHC updates the upper dword of its internal command ring pointer with all zeros. Next time, when the command ring is restarted, we see xHC memory access failures. Fix this issue by only writing to the lower dword of CRCR where all control bits are located.
Which versions are affected by CVE-2021-47434?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47434?
Apply the vendor's patch.
Is CVE-2021-47434 being exploited?
There is no known exploitation of CVE-2021-47434 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47434, GHSA-5ggq-5m2f-79jm, UBUNTU-CVE-2021-47434.