PT-2021-8189 · Linux+3 · Linux Kernel+3

Johan Hovold · Published 2021-10-30 · Updated 2024-11-25 · CVE-2021-47476

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the comedi driver, specifically the ni usb6501 component, which lacks proper sanity checks on USB transfer buffer sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501 port command() and ni6501 counter command() if a malicious device has smaller max-packet sizes than expected. The vulnerability can be exploited when doing descriptor fuzz testing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

RCE

Weakness Enumeration

CWE-476

CWE-20

Related Identifiers

BDU:2024-10517

CVE-2021-47476

OESA-2024-1705

OPENSUSE-SU-2024_2189-1

SUSE-SU-2024:2008-1

SUSE-SU-2024:2011-1

SUSE-SU-2024:2019-1

SUSE-SU-2024:2189-1

SUSE-SU-2024:2190-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 1311

• 🔥 https://github.com/lanleft/CVE-2023-1829 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-35811 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36902 · Security Note
• https://git.kernel.org/stable/c/4a9d43cb5d5f39fa39fc1da438517004cc95f7ea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36883 · Security Note
• https://git.kernel.org/stable/c/aa39738423503825625853b643b9e99d11c23816 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-47476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47543 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36964 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52686 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-47403 · Security Note
• https://ubuntu.com/security/CVE-2021-47476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36954 · Security Note