CVE-2021-47267 is a medium severity vulnerability in the Linux kernel related to USB gadget drivers handling descriptors for USB 10Gbps (USB 3.1 SuperSpeedPlus) connections. The Linux kernel function usb_assign_descriptors() is called with five parameters representing USB descriptors for different speeds: full-speed (USB 1.1), high-speed (USB 2.0), super-speed (USB 3.0), and super-speed-plus (USB 3.1). The vulnerability arises when a gadget driver provides a NULL descriptor for the super-speed-plus (10Gbps) parameter. If the device is connected using a 10Gbps capable port, cable, and host combination, the kernel dereferences this NULL pointer, causing a kernel panic (crash). This occurs because the kernel defaults to the maximum speed and expects a valid descriptor for 10Gbps, but the driver fails to provide one. The root cause is the lack of a fallback mechanism to use the 5Gbps descriptor for 10Gbps connections if the latter is missing. The fix involves using the 5Gbps descriptor as a substitute when the 10Gbps descriptor is NULL. However, if both 5Gbps and 10Gbps descriptors are NULL, the issue cannot be trivially resolved, though such cases are rare and unlikely to be used with USB3 ports. This vulnerability can be triggered remotely by connecting a USB device with a vulnerable gadget driver to a 10Gbps USB port, leading to denial of service via kernel crash. The CVSS score is 6.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality, integrity, and availability. No known exploits are reported in the wild yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with vulnerable gadget drivers that handle USB devices, especially those using USB 3.1 (10Gbps) ports. The impact includes potential denial of service due to kernel panics, which can disrupt critical services, cause system downtime, and require reboots. Confidentiality and integrity impacts are rated low to medium but cannot be fully excluded if attackers leverage the crash to escalate privileges or bypass security controls. Organizations with Linux-based infrastructure in sectors such as telecommunications, manufacturing, research, and public services that rely on USB-connected devices for data acquisition or peripheral connectivity are particularly at risk. The vulnerability requires local privileges to exploit (PR:L), meaning an attacker must have some level of access to the system or be able to plug in a malicious USB device. This limits remote exploitation but does not eliminate risk from insider threats or compromised endpoints. Given the widespread use of Linux in European data centers, embedded systems, and IoT devices, the vulnerability could affect a broad range of environments if unpatched. The lack of known exploits reduces immediate risk but patching is critical to prevent future attacks.

1. Apply the latest Linux kernel updates that include the patch for CVE-2021-47267 to ensure the fallback mechanism for USB descriptors is implemented. 2. Audit and update USB gadget drivers in use to verify they provide valid descriptors for all supported USB speeds, especially 10Gbps super-speed-plus. 3. Implement strict USB device control policies to limit physical USB port access and prevent unauthorized device connections, including use of USB device whitelisting or endpoint security solutions. 4. Monitor system logs for kernel panics or USB-related errors that could indicate attempted exploitation or misconfigured devices. 5. For critical systems, consider disabling USB 3.1 ports or limiting USB speed capabilities temporarily if patching is delayed, to reduce exposure. 6. Educate users and administrators about the risks of connecting untrusted USB devices and enforce least privilege principles to minimize local access. 7. In embedded or IoT environments, ensure firmware and kernel versions are regularly updated and tested for this vulnerability. 8. Coordinate with hardware vendors to confirm compatibility and support for patched Linux kernels and USB descriptors.