CVE-2021-47475 comedi: vmk80xx: fix transfer-buffer overflows
A buffer overflow in the vmk80xx USB driver allows attackers with physical access to execute code or crash the system via malicious device descriptors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47475?
CVE-2021-47475 is a high-severity memory corruption vulnerability in Linux kernel, published on 22 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
comedi: vmk80xx: fix transfer-buffer overflows
The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes.
Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing.
The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
Weakness: CWE-787
Which versions are affected by CVE-2021-47475?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47475?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-47475 being exploited?
There is no known exploitation of CVE-2021-47475 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47475, GHSA-6w3g-x8mp-cp7x, UBUNTU-CVE-2021-47475.