CVE-2021-47475

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47475
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 Patch
https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 Patch
https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 Patch
https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 Patch
https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 Patch
https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f Patch
https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 Patch
https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 Patch
https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba Patch
https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 Patch
https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 Patch
https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 Patch
https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 Patch
https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 Patch
https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f Patch
https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 Patch
https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 Patch
https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Sep 2025, 18:58

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 - () https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 - Patch
References () https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 - () https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 - Patch
References () https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 - () https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 - Patch
References () https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 - () https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 - Patch
References () https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 - () https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 - Patch
References () https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f - () https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f - Patch
References () https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 - () https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 - Patch
References () https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 - () https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 - Patch
References () https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba - () https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba - Patch
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

21 Nov 2024, 06:36

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 - () https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 -
References () https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 - () https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 -
References () https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 - () https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 -
References () https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 - () https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 -
References () https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 - () https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 -
References () https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f - () https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f -
References () https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 - () https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 -
References () https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 - () https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 -
References () https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba - () https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: comedi: vmk80xx: corrige desbordamientos del búfer de transferencia El controlador utiliza búferes de transferencia USB del tamaño de un terminal, pero hasta hace poco no tenía controles de cordura sobre los tamaños. el commit e1f13c879a7c ("staging: comedi: verificar la validez de wMaxPacketSize de los endpoints USB encontrados") corrigió inadvertidamente las desreferencias de puntero NULL al acceder a los buffers de transferencia en caso de que un dispositivo malicioso tenga un wMaxPacketSize cero. Asegúrese de asignar buffers lo suficientemente grandes para manejar también los otros accesos que se realizan sin una verificación de tamaño (por ejemplo, el byte 18 en vmk80xx_cnt_insn_read() para VMK8061_MODEL) para evitar escribir más allá de los buffers, por ejemplo, cuando se realiza una confusión de descriptores. El controlador original era para un dispositivo de baja velocidad con buffers de 8 bytes. Posteriormente se agregó soporte para un dispositivo que utiliza transferencias masivas y presumiblemente es un dispositivo de velocidad completa con un wMaxPacketSize máximo de 64 bytes.

22 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 09:15

Updated : 2025-09-24 18:58

NVD link : CVE-2021-47475

Mitre link : CVE-2021-47475

CVE.ORG link : CVE-2021-47475

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write