CVE-2021-47475
published 2024-05-22CVE-2021-47475: In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.
Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.
The original driver was for a low-speed device with 8-byte buffers.
Support was later added for a device that uses bulk transfers and is
presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.15.3-1 (bookworm) | linux 5.15.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 5229159f1d052821007aff1a1beb7873eacf1a9f | 5229159f1d052821007aff1a1beb7873eacf1a9f |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < ec85bcff4ed09260243d8f39faba99e1041718ba | ec85bcff4ed09260243d8f39faba99e1041718ba |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 | 40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 7a2021b896de1ad559d33b5c5cdd20b982242088 | 7a2021b896de1ad559d33b5c5cdd20b982242088 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 199acd8c110e3ae62833c24f632b0bb1c9f012a9 | 199acd8c110e3ae62833c24f632b0bb1c9f012a9 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 33d7a470730dfe7c9bfc8da84575cf2cedd60d00 | 33d7a470730dfe7c9bfc8da84575cf2cedd60d00 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 278484ae93297b1bb1ce755f9d3b6d95a48c7d47 | 278484ae93297b1bb1ce755f9d3b6d95a48c7d47 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < 06ac746d57e6d32b062e220415c607b7e2e0fa50 | 06ac746d57e6d32b062e220415c607b7e2e0fa50 |
| linux | linux | >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb < a23461c47482fc232ffc9b819539d1f837adf2b1 | a23461c47482fc232ffc9b819539d1f837adf2b1 |
| linux | linux_kernel | >= 0 < 5.10.84-1 | 5.10.84-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 0 < 5.15.3-1 | 5.15.3-1 |
| linux | linux_kernel | >= 2.6.31 < 4.4.292 | 4.4.292 |
| linux | linux_kernel | >= 4.10 < 4.14.255 | 4.14.255 |
| linux | linux_kernel | >= 4.15 < 4.19.217 | 4.19.217 |
| linux | linux_kernel | >= 4.20 < 5.4.159 | 5.4.159 |
| linux | linux_kernel | >= 4.5 < 4.9.290 | 4.9.290 |
| linux | linux_kernel | >= 5.11 < 5.14.18 | 5.14.18 |
| linux | linux_kernel | >= 5.15 < 5.15.2 | 5.15.2 |
| linux | linux_kernel | >= 5.5 < 5.10.79 | 5.10.79 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: comedi: vmk80xx: fix transfer-buffer overflows
vendor_redhat·2024-05-22·CVSS 7.8
CVE-2021-47475 [HIGH] CWE-787 kernel: comedi: vmk80xx: fix transfer-buffer overflows
kernel: comedi: vmk80xx: fix transfer-buffer overflows
In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.
Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.
The original driver was for a
Debian
CVE-2021-47475: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: vmk...
vendor_debian·2021·CVSS 7.8
CVE-2021-47475 [HIGH] CVE-2021-47475: linux - In the Linux kernel, the following vulnerability has been resolved: comedi: vmk...
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later
GHSA
GHSA-6w3g-x8mp-cp7x: In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized US
ghsa_unreviewed·2024-05-22
CVE-2021-47475 [HIGH] CWE-787 GHSA-6w3g-x8mp-cp7x: In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized US
In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.
Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.
The original driver was for a low-speed device with 8-byte buffers.
Support was l
OSV
CVE-2021-47475: In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB
osv·2024-05-22·CVSS 7.8
CVE-2021-47475 [HIGH] CVE-2021-47475: In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9fhttps://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718bahttps://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9fhttps://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba
2024-05-22
Published