CVE-2021-47270: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered affecting various USB gadget functions when using 10Gbps cabling. The issue involves a null pointer dereference in multiple functions including f_ecm, f_eem, f_hid, f_loopback, f_printer, f_rndis, f_serial, f_sourcesink, f_subset, and f_tcm. This vulnerability was introduced by a previous update to USB gadget descriptors for SuperSpeedPlus support (Kernel Git).

The vulnerability stems from improper handling of USB descriptors when operating at 10Gbps speeds. The issue was fixed by reusing the 5Gbps configuration for 10Gbps operations, preventing the null pointer dereference. The fix involved modifying the usb_assign_descriptors function calls across multiple gadget drivers to use the same SuperSpeed descriptors for SuperSpeedPlus operation (Kernel Git).

When exploited, this vulnerability could lead to a null pointer dereference in the Linux kernel when USB devices are connected using 10Gbps cabling. This could potentially result in system crashes or denial of service conditions (NVD).

The vulnerability requires physical access to the system and specific USB hardware capable of 10Gbps operation. It is triggered during normal USB device operation when using SuperSpeedPlus (10Gbps) connections (Kernel Git).

The issue has been resolved in the Linux kernel through a patch that modifies the USB gadget drivers to properly handle 10Gbps connections. Users should update to a patched version of the kernel that includes the fix. The patch ensures proper descriptor handling by reusing the 5Gbps configuration for 10Gbps operations (Kernel Git).