cve-2021-47475
Vulnerability from cvelistv5
Published
2024-05-22 08:19
Modified
2024-08-04 05:39
Severity
Summary
comedi: vmk80xx: fix transfer-buffer overflows
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T17:52:35.271810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:48.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.742Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/vmk80xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5229159f1d05",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "ec85bcff4ed0",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "40d2a7e278e2",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "7a2021b896de",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "199acd8c110e",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "33d7a470730d",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "278484ae9329",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "06ac746d57e6",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            },
            {
              "lessThan": "a23461c47482",
              "status": "affected",
              "version": "985cafccbf9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/vmk80xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.292",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.290",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.255",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.217",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.159",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.79",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.18",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix transfer-buffer overflows\n\nThe driver uses endpoint-sized USB transfer buffers but up until\nrecently had no sanity checks on the sizes.\n\nCommit e1f13c879a7c (\"staging: comedi: check validity of wMaxPacketSize\nof usb endpoints found\") inadvertently fixed NULL-pointer dereferences\nwhen accessing the transfer buffers in case a malicious device has a\nzero wMaxPacketSize.\n\nMake sure to allocate buffers large enough to handle also the other\naccesses that are done without a size check (e.g. byte 18 in\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\nthe buffers, for example, when doing descriptor fuzzing.\n\nThe original driver was for a low-speed device with 8-byte buffers.\nSupport was later added for a device that uses bulk transfers and is\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:08:36.562Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088"
        },
        {
          "url": "https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00"
        },
        {
          "url": "https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47"
        },
        {
          "url": "https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50"
        },
        {
          "url": "https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1"
        }
      ],
      "title": "comedi: vmk80xx: fix transfer-buffer overflows",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47475",
    "datePublished": "2024-05-22T08:19:29.423Z",
    "dateReserved": "2024-05-22T06:20:56.200Z",
    "dateUpdated": "2024-08-04T05:39:59.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47475\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T09:15:09.370\",\"lastModified\":\"2024-05-22T12:46:53.887\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: vmk80xx: fix transfer-buffer overflows\\n\\nThe driver uses endpoint-sized USB transfer buffers but up until\\nrecently had no sanity checks on the sizes.\\n\\nCommit e1f13c879a7c (\\\"staging: comedi: check validity of wMaxPacketSize\\nof usb endpoints found\\\") inadvertently fixed NULL-pointer dereferences\\nwhen accessing the transfer buffers in case a malicious device has a\\nzero wMaxPacketSize.\\n\\nMake sure to allocate buffers large enough to handle also the other\\naccesses that are done without a size check (e.g. byte 18 in\\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\\nthe buffers, for example, when doing descriptor fuzzing.\\n\\nThe original driver was for a low-speed device with 8-byte buffers.\\nSupport was later added for a device that uses bulk transfers and is\\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: comedi: vmk80xx: corrige desbordamientos del b\u00fafer de transferencia El controlador utiliza b\u00faferes de transferencia USB del tama\u00f1o de un terminal, pero hasta hace poco no ten\u00eda controles de cordura sobre los tama\u00f1os. el commit e1f13c879a7c (\\\"staging: comedi: verificar la validez de wMaxPacketSize de los endpoints USB encontrados\\\") corrigi\u00f3 inadvertidamente las desreferencias de puntero NULL al acceder a los buffers de transferencia en caso de que un dispositivo malicioso tenga un wMaxPacketSize cero. Aseg\u00farese de asignar buffers lo suficientemente grandes para manejar tambi\u00e9n los otros accesos que se realizan sin una verificaci\u00f3n de tama\u00f1o (por ejemplo, el byte 18 en vmk80xx_cnt_insn_read() para VMK8061_MODEL) para evitar escribir m\u00e1s all\u00e1 de los buffers, por ejemplo, cuando se realiza una confusi\u00f3n de descriptores. El controlador original era para un dispositivo de baja velocidad con buffers de 8 bytes. Posteriormente se agreg\u00f3 soporte para un dispositivo que utiliza transferencias masivas y presumiblemente es un dispositivo de velocidad completa con un wMaxPacketSize m\u00e1ximo de 64 bytes.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.