CVE-2021-43976: Linux Kernel mwifiex USB DoS Vulnerability

CVE-2021-43976 Overview

CVE-2021-43976 is a denial of service vulnerability in the Linux kernel through version 5.15.2. The flaw resides in the mwifiex_usb_recv function within drivers/net/wireless/marvell/mwifiex/usb.c, which handles incoming USB packets for Marvell Wi-Fi adapters. An attacker who can physically connect a crafted USB device can trigger an skb_over_panic kernel panic, causing the system to crash. The vulnerability affects multiple Linux distributions and downstream products that ship affected kernel versions, including Debian, Fedora, NetApp HCI firmware, and Oracle Communications Cloud Native Core components.

Critical Impact
Physical attackers with USB access can crash affected Linux systems by connecting a malicious USB device emulating a Marvell wireless adapter, resulting in availability loss through kernel panic.

Affected Products

Linux kernel through version 5.15.2
Debian Linux 9.0, 10.0, and 11.0; Fedora 34 and 35
NetApp HCI compute/storage nodes (H300S/E, H500S/E, H700S/E, H410S, H410C) and Oracle Communications Cloud Native Core (Binding Support Function 22.1.3, Network Exposure Function 22.1.1, Policy 22.2.0)

Discovery Timeline

2021-11-17 - CVE-2021-43976 published to NVD
2021-12-10 - NetApp publishes security advisory NTAP-20211210-0001
2022-03 - Debian LTS announcements and DSA-5092/DSA-5096 released
2022-07 - Oracle addresses the issue in the July 2022 Critical Patch Update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43976

Vulnerability Analysis

The Marvell mwifiex driver supports Wi-Fi chipsets over multiple bus types, including USB. When the kernel receives USB packets through mwifiex_usb_recv, the function allocates a socket buffer (skb) and copies USB transfer data into it for further processing. The driver fails to properly validate the size of incoming USB packets against the allocated skb capacity. A crafted USB device acting as a malicious Marvell adapter can deliver oversized frames that overflow the buffer boundary, triggering the kernel's skb_over_panic safety check. This panic halts the kernel and renders the system unavailable until reboot. The vulnerability is classified as a denial of service issue under [CWE-NVD-noinfo] because no metadata for memory corruption beyond the panic is recorded.

Root Cause

The root cause is missing length validation between the USB endpoint data length and the socket buffer size in mwifiex_usb_recv. The driver trusted device-supplied length fields without enforcing an upper bound that matches the receive buffer allocation. The upstream fix, committed as 04d80663f67c, adds the necessary bounds checking before data is copied into the skb.

Attack Vector

Exploitation requires physical access to a USB port on the target machine. The attacker connects a programmable USB device, such as a Facedancer or BadUSB-class adapter, that enumerates as a Marvell wireless chipset bound by mwifiex_usb. Once the driver binds, the malicious device emits oversized USB transfers shaped to bypass the receive path checks. No authentication or user interaction beyond the physical USB insertion is required. The attack yields no code execution or data disclosure based on available metadata, only an availability impact through kernel panic.

The vulnerability manifests in the boundary handling of USB receive buffers in the mwifiex_usb_recv function. See the upstream commit Linux Kernel Commit 04d80663f67c and the Linux Wireless Patch for technical details.

Detection Methods for CVE-2021-43976

Indicators of Compromise

Kernel panic messages referencing skb_over_panic originating from the mwifiex_usb module in dmesg or system logs
Unexpected system reboots or hangs correlated with USB device insertion events
USB enumeration entries showing Marvell wireless device IDs from non-inventoried hardware

Detection Strategies

Audit running kernel versions across the fleet using uname -r and compare against patched versions distributed via Debian DSA-5092, DSA-5096, and Fedora package announcements
Monitor udev and kernel logs for mwifiex_usb driver binding events on systems that do not legitimately use Marvell USB Wi-Fi adapters
Correlate physical access logs with kernel panic events on critical infrastructure such as NetApp HCI nodes and Oracle Communications platforms

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on skb_over_panic strings or sudden kernel oops events tied to wireless drivers
Track USB device insertion events through endpoint telemetry, focusing on servers and infrastructure systems where USB use is unexpected
Inventory firmware versions on NetApp HCI nodes against NetApp Security Advisory NTAP-20211210-0001

How to Mitigate CVE-2021-43976

Immediate Actions Required

Update the Linux kernel to a version that includes commit 04d80663f67c on all affected hosts, prioritizing systems exposed to physical access
Apply distribution patches: Debian DSA-5092 and DSA-5096 for Debian 10/11, and the corresponding Fedora 34/35 package updates
Patch NetApp HCI firmware per the vendor advisory and apply the Oracle July 2022 Critical Patch Update for affected Communications Cloud Native Core products

Patch Information

The fix landed upstream as Linux kernel commit 04d80663f67ccef893061b49ec8a42ff7045ae84, which adds proper length validation in mwifiex_usb_recv. Distribution-level fixes are tracked in Debian Security Advisory DSA-5092, Debian Security Advisory DSA-5096, the Fedora Package Announcement, and the Oracle CPU July 2022 Alert.

Workarounds

Blacklist the mwifiex_usb kernel module on systems that do not require Marvell USB Wi-Fi support to prevent the vulnerable driver from binding
Disable or physically restrict USB ports on servers, infrastructure appliances, and unattended endpoints to remove the physical attack vector
Enforce USB device control policies, such as usbguard, to allow only an approved set of vendor/product IDs to bind

bash

# Configuration example: blacklist the vulnerable driver and reload
echo "blacklist mwifiex_usb" | sudo tee /etc/modprobe.d/blacklist-mwifiex-usb.conf
sudo rmmod mwifiex_usb 2>/dev/null || true
sudo update-initramfs -u

# Example usbguard policy: allow only specific approved devices
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard