CVE-2021-47333: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge
In the Linux kernel, the following vulnerability has been resolved:
misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge
There is an issue with the ASPM(optional) capability checking function.
A device might be attached to root complex directly, in this case,
bus->self(bridge) will be NULL, thus priv->parent_pdev is NULL.
Since alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's
ASPM capability and populate parent_cap_off, which will be used later by
alcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do
here is to avoid checking the capability if we are on the root complex.
This will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply
return when bring called, effectively disable ASPM for the device.
[ 1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0
[ 1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40
[ 1.253998] Call Trace:
[ 1.254131] ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci]
[ 1.254476] alcor_pci_probe+0x169/0x2d5 [alcor_pci]
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash affected systems when the alcor_pci driver checks PCI power-management capability on hardware without a PCI bridge. The impact is availability, not data theft or privilege escalation. Business urgency depends on whether affected kernels and this driver/hardware path exist in your fleet.
Executive priority
Treat as a routine kernel availability patch unless affected hardware is common in critical endpoints or appliances. It does not appear to require emergency response from the provided evidence, but unpatched kernel crash conditions can still disrupt operations.
Technical view
The alcor_pci driver could dereference a null parent PCI device when a device is attached directly to the root complex. The fix skips ASPM capability checking in that topology, leaving ASPM disabled for the device. CVSS is 5.5: local, low-privilege, no user interaction, high availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with the alcor_pci driver and relevant PCI topology. The bundle does not identify affected distributions, appliances, or cloud images, so teams should map vendor kernel backports rather than relying only on upstream version numbers.
Exploitation context
No active exploitation is indicated: KEV is false and the provided sources cite no public exploitation. The CVSS vector indicates a local, low-privilege availability issue. The source evidence shows a kernel null pointer dereference during driver probe, but does not provide exploitability beyond denial of service.
Researcher notes
The key technical condition is bus->self being null for a device directly under the root complex. The fix avoids parent ASPM capability probing in that case, causing later ASPM control to return without changing device power behavior. Source evidence is strong for root cause and fix, limited for exploit prevalence.
Mitigation direction
Update to a vendor-supported Linux kernel containing the referenced upstream stable fix.
Check distribution advisories for backported fixes for CVE-2021-47333.
Prioritize systems where alcor_pci is present or relevant PCI card-reader hardware exists.
Reboot into the fixed kernel after patching if required by your vendor.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2021-47333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.