LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47333: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

In the Linux kernel, the following vulnerability has been resolved: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge There is an issue with the ASPM(optional) capability checking function. A device might be attached to root complex directly, in this case, bus->self(bridge) will be NULL, thus priv->parent_pdev is NULL. Since alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's ASPM capability and populate parent_cap_off, which will be used later by alcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do here is to avoid checking the capability if we are on the root complex. This will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply return when bring called, effectively disable ASPM for the device. [ 1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40 [ 1.253998] Call Trace: [ 1.254131] ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci] [ 1.254476] alcor_pci_probe+0x169/0x2d5 [alcor_pci]

MediumCVSS 5.5Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected systems when the alcor_pci driver checks PCI power-management capability on hardware without a PCI bridge. The impact is availability, not data theft or privilege escalation. Business urgency depends on whether affected kernels and this driver/hardware path exist in your fleet.

Executive priority

Treat as a routine kernel availability patch unless affected hardware is common in critical endpoints or appliances. It does not appear to require emergency response from the provided evidence, but unpatched kernel crash conditions can still disrupt operations.

Technical view

The alcor_pci driver could dereference a null parent PCI device when a device is attached directly to the root complex. The fix skips ASPM capability checking in that topology, leaving ASPM disabled for the device. CVSS is 5.5: local, low-privilege, no user interaction, high availability impact.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions with the alcor_pci driver and relevant PCI topology. The bundle does not identify affected distributions, appliances, or cloud images, so teams should map vendor kernel backports rather than relying only on upstream version numbers.

Exploitation context

No active exploitation is indicated: KEV is false and the provided sources cite no public exploitation. The CVSS vector indicates a local, low-privilege availability issue. The source evidence shows a kernel null pointer dereference during driver probe, but does not provide exploitability beyond denial of service.

Researcher notes

The key technical condition is bus->self being null for a device directly under the root complex. The fix avoids parent ASPM capability probing in that case, causing later ASPM control to return without changing device power behavior. Source evidence is strong for root cause and fix, limited for exploit prevalence.

Mitigation direction

  • Update to a vendor-supported Linux kernel containing the referenced upstream stable fix.
  • Check distribution advisories for backported fixes for CVE-2021-47333.
  • Prioritize systems where alcor_pci is present or relevant PCI card-reader hardware exists.
  • Reboot into the fixed kernel after patching if required by your vendor.
  • Avoid unsupported driver workarounds unless vendor guidance explicitly recommends them.

Validation and detection

  • Inventory Linux kernel versions and compare them with vendor CVE-2021-47333 advisories.
  • Check whether the alcor_pci driver is present, loaded, or built into managed systems.
  • Confirm patched kernels include one of the referenced stable commits or vendor backport.
  • Review kernel logs for alcor_pci probe crashes or null pointer dereference traces.
  • Document systems where hardware exposure cannot be confirmed from inventory data.
Prepared
Confidence
high
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47333 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2021-47333Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4f556bc04e3c0de2f5c69adc9e9f2bcefcad079d, 4f556bc04e3c0de2f5c69adc9e9f2bcefcad079d, 4f556bc04e3c0de2f5c69adc9e9f2bcefcad079d, 4f556bc04e3c0de2f5c69adc9e9f2bcefcad079d, 4f556bc04e3c0de2f5c69adc9e9f2bcefcad079dunaffected
LinuxLinux5.0, 0, 5.4.134, 5.10.52, 5.12.19, 5.13.4, 5.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.