PT-2021-8185 · Linux+3 · Linux Kernel+3
Johan Hovold
·
Published
2021-10-26
·
Updated
2025-09-24
·
CVE-2021-47475
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the comedi driver in the Linux kernel, specifically the vmk80xx component. It involves a problem with transfer-buffer overflows due to the lack of sanity checks on buffer sizes. The driver uses endpoint-sized USB transfer buffers, and a commit inadvertently fixed NULL-pointer dereferences when accessing transfer buffers in case a malicious device has a zero wMaxPacketSize. To avoid writing beyond buffers, it is recommended to allocate buffers large enough to handle other accesses done without size checks. The original driver was for a low-speed device with 8-byte buffers, and support was later added for a device using bulk transfers, presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse