CVE-2021-47267: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47267 affects the Linux kernel's USB gadget functionality. The vulnerability was discovered in the usb_assign_descriptors() function, which handles USB device descriptors for different speed configurations (USB 1.1, 2.0, 3.0, and 3.1). The issue was fixed in June 2021 (Kernel Commit).

The vulnerability occurs in the USB gadget driver's descriptor assignment functionality. The usb_assign_descriptors() function takes 5 parameters, including descriptors for different USB speeds: full-speed (12Mbps), high-speed (480Mbps), super-speed (5Gbps), and super-speed-plus (10Gbps). When a gadget driver calls this function with a NULL descriptor for super-speed-plus mode and is used in a 10Gbps configuration, it can result in a null pointer dereference when connected to a 10Gbps capable setup (Kernel Commit).

When triggered, this vulnerability can cause the Linux kernel to crash (kernel panic) when a USB device is connected using 10Gbps capable hardware (device port + cable + host port combination). This affects systems where USB 3.1 (10Gbps) connections are used with affected gadget drivers (Kernel Commit).

The vulnerability is triggered through normal USB device operation and requires physical access to connect a USB device using 10Gbps capable hardware. The issue occurs specifically when a gadget driver doesn't provide a super-speed-plus descriptor but is used in a 10Gbps configuration (Kernel Commit).

The fix involves modifying the usb_assign_descriptors() function to use the 5Gbps (super-speed) descriptor as a fallback when no 10Gbps (super-speed-plus) descriptor is provided. This prevents the null pointer dereference while maintaining compatibility with high-speed USB devices (Kernel Commit).