Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-47434
HistoryMay 22, 2024 - 12:00 a.m.

CVE-2021-47434

2024-05-2200:00:00
ubuntu.com
ubuntu.com
linux
kernel
vulnerability
xhci
command ring
corruption
fix

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

In the Linux kernel, the following vulnerability has been resolved: xhci:
Fix command ring pointer corruption while aborting a command The command
ring pointer is located at [6:63] bits of the command ring control register
(CRCR). All the control bits like command stop, abort are located at [0:3]
bits. While aborting a command, we read the CRCR and set the abort bit and
write to the CRCR. The read will always give command ring pointer as all
zeros. So we essentially write only the control bits. Since we split the 64
bit write into two 32 bit writes, there is a possibility of xHC command
ring stopped before the upper dword (all zeros) is written. If that
happens, xHC updates the upper dword of its internal command ring pointer
with all zeros. Next time, when the command ring is restarted, we see xHC
memory access failures. Fix this issue by only writing to the lower dword
of CRCR where all control bits are located.

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%