GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47475 (GCVE-0-2021-47475)

Vulnerability from cvelistv5 – Published: 2024-05-22 08:19 – Updated: 2026-05-11 13:55
VLAI
Title
comedi: vmk80xx: fix transfer-buffer overflows
Summary
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 17:52 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 5229159f1d052821007aff1a1beb7873eacf1a9f (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < ec85bcff4ed09260243d8f39faba99e1041718ba (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 7a2021b896de1ad559d33b5c5cdd20b982242088 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 199acd8c110e3ae62833c24f632b0bb1c9f012a9 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 33d7a470730dfe7c9bfc8da84575cf2cedd60d00 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 278484ae93297b1bb1ce755f9d3b6d95a48c7d47 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < 06ac746d57e6d32b062e220415c607b7e2e0fa50 (git)
Affected: 985cafccbf9b7f862aa1c5ee566801e18b5161fb , < a23461c47482fc232ffc9b819539d1f837adf2b1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 4.4.292 , ≤ 4.4.* (semver)
Unaffected: 4.9.290 , ≤ 4.9.* (semver)
Unaffected: 4.14.255 , ≤ 4.14.* (semver)
Unaffected: 4.19.217 , ≤ 4.19.* (semver)
Unaffected: 5.4.159 , ≤ 5.4.* (semver)
Unaffected: 5.10.79 , ≤ 5.10.* (semver)
Unaffected: 5.14.18 , ≤ 5.14.* (semver)
Unaffected: 5.15.2 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T17:52:35.271810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:48.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.742Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/vmk80xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5229159f1d052821007aff1a1beb7873eacf1a9f",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "ec85bcff4ed09260243d8f39faba99e1041718ba",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "7a2021b896de1ad559d33b5c5cdd20b982242088",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "199acd8c110e3ae62833c24f632b0bb1c9f012a9",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "33d7a470730dfe7c9bfc8da84575cf2cedd60d00",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "278484ae93297b1bb1ce755f9d3b6d95a48c7d47",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "06ac746d57e6d32b062e220415c607b7e2e0fa50",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            },
            {
              "lessThan": "a23461c47482fc232ffc9b819539d1f837adf2b1",
              "status": "affected",
              "version": "985cafccbf9b7f862aa1c5ee566801e18b5161fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/vmk80xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.255",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.292",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.290",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.255",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.217",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.159",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.79",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.18",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.2",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix transfer-buffer overflows\n\nThe driver uses endpoint-sized USB transfer buffers but up until\nrecently had no sanity checks on the sizes.\n\nCommit e1f13c879a7c (\"staging: comedi: check validity of wMaxPacketSize\nof usb endpoints found\") inadvertently fixed NULL-pointer dereferences\nwhen accessing the transfer buffers in case a malicious device has a\nzero wMaxPacketSize.\n\nMake sure to allocate buffers large enough to handle also the other\naccesses that are done without a size check (e.g. byte 18 in\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\nthe buffers, for example, when doing descriptor fuzzing.\n\nThe original driver was for a low-speed device with 8-byte buffers.\nSupport was later added for a device that uses bulk transfers and is\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:55:24.292Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088"
        },
        {
          "url": "https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00"
        },
        {
          "url": "https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47"
        },
        {
          "url": "https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50"
        },
        {
          "url": "https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1"
        }
      ],
      "title": "comedi: vmk80xx: fix transfer-buffer overflows",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47475",
    "datePublished": "2024-05-22T08:19:29.423Z",
    "dateReserved": "2024-05-22T06:20:56.200Z",
    "dateUpdated": "2026-05-11T13:55:24.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47475",
      "date": "2026-09-13",
      "epss": "0.00259",
      "percentile": "0.17581"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: vmk80xx: fix transfer-buffer overflows\\n\\nThe driver uses endpoint-sized USB transfer buffers but up until\\nrecently had no sanity checks on the sizes.\\n\\nCommit e1f13c879a7c (\\\"staging: comedi: check validity of wMaxPacketSize\\nof usb endpoints found\\\") inadvertently fixed NULL-pointer dereferences\\nwhen accessing the transfer buffers in case a malicious device has a\\nzero wMaxPacketSize.\\n\\nMake sure to allocate buffers large enough to handle also the other\\naccesses that are done without a size check (e.g. byte 18 in\\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\\nthe buffers, for example, when doing descriptor fuzzing.\\n\\nThe original driver was for a low-speed device with 8-byte buffers.\\nSupport was later added for a device that uses bulk transfers and is\\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: comedi: vmk80xx: corrige desbordamientos del b\\u00fafer de transferencia El controlador utiliza b\\u00faferes de transferencia USB del tama\\u00f1o de un terminal, pero hasta hace poco no ten\\u00eda controles de cordura sobre los tama\\u00f1os. el commit e1f13c879a7c (\\\"staging: comedi: verificar la validez de wMaxPacketSize de los endpoints USB encontrados\\\") corrigi\\u00f3 inadvertidamente las desreferencias de puntero NULL al acceder a los buffers de transferencia en caso de que un dispositivo malicioso tenga un wMaxPacketSize cero. Aseg\\u00farese de asignar buffers lo suficientemente grandes para manejar tambi\\u00e9n los otros accesos que se realizan sin una verificaci\\u00f3n de tama\\u00f1o (por ejemplo, el byte 18 en vmk80xx_cnt_insn_read() para VMK8061_MODEL) para evitar escribir m\\u00e1s all\\u00e1 de los buffers, por ejemplo, cuando se realiza una confusi\\u00f3n de descriptores. El controlador original era para un dispositivo de baja velocidad con buffers de 8 bytes. Posteriormente se agreg\\u00f3 soporte para un dispositivo que utiliza transferencias masivas y presumiblemente es un dispositivo de velocidad completa con un wMaxPacketSize m\\u00e1ximo de 64 bytes.\"}]",
      "id": "CVE-2021-47475",
      "lastModified": "2024-11-21T06:36:15.267",
      "published": "2024-05-22T09:15:09.370",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47475\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T09:15:09.370\",\"lastModified\":\"2026-06-17T04:17:33.480\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: vmk80xx: fix transfer-buffer overflows\\n\\nThe driver uses endpoint-sized USB transfer buffers but up until\\nrecently had no sanity checks on the sizes.\\n\\nCommit e1f13c879a7c (\\\"staging: comedi: check validity of wMaxPacketSize\\nof usb endpoints found\\\") inadvertently fixed NULL-pointer dereferences\\nwhen accessing the transfer buffers in case a malicious device has a\\nzero wMaxPacketSize.\\n\\nMake sure to allocate buffers large enough to handle also the other\\naccesses that are done without a size check (e.g. byte 18 in\\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\\nthe buffers, for example, when doing descriptor fuzzing.\\n\\nThe original driver was for a low-speed device with 8-byte buffers.\\nSupport was later added for a device that uses bulk transfers and is\\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: comedi: vmk80xx: corrige desbordamientos del b\u00fafer de transferencia El controlador utiliza b\u00faferes de transferencia USB del tama\u00f1o de un terminal, pero hasta hace poco no ten\u00eda controles de cordura sobre los tama\u00f1os. el commit e1f13c879a7c (\\\"staging: comedi: verificar la validez de wMaxPacketSize de los endpoints USB encontrados\\\") corrigi\u00f3 inadvertidamente las desreferencias de puntero NULL al acceder a los buffers de transferencia en caso de que un dispositivo malicioso tenga un wMaxPacketSize cero. Aseg\u00farese de asignar buffers lo suficientemente grandes para manejar tambi\u00e9n los otros accesos que se realizan sin una verificaci\u00f3n de tama\u00f1o (por ejemplo, el byte 18 en vmk80xx_cnt_insn_read() para VMK8061_MODEL) para evitar escribir m\u00e1s all\u00e1 de los buffers, por ejemplo, cuando se realiza una confusi\u00f3n de descriptores. El controlador original era para un dispositivo de baja velocidad con buffers de 8 bytes. Posteriormente se agreg\u00f3 soporte para un dispositivo que utiliza transferencias masivas y presumiblemente es un dispositivo de velocidad completa con un wMaxPacketSize m\u00e1ximo de 64 bytes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/comedi/drivers/vmk80xx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"5229159f1d052821007aff1a1beb7873eacf1a9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"ec85bcff4ed09260243d8f39faba99e1041718ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"7a2021b896de1ad559d33b5c5cdd20b982242088\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"199acd8c110e3ae62833c24f632b0bb1c9f012a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"33d7a470730dfe7c9bfc8da84575cf2cedd60d00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"278484ae93297b1bb1ce755f9d3b6d95a48c7d47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"06ac746d57e6d32b062e220415c607b7e2e0fa50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"985cafccbf9b7f862aa1c5ee566801e18b5161fb\",\"lessThan\":\"a23461c47482fc232ffc9b819539d1f837adf2b1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/comedi/drivers/vmk80xx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.31\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.31\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.4.292\",\"lessThanOrEqual\":\"4.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.290\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.255\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.217\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.159\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.79\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.18\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.2\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T17:52:35.271810Z\",\"id\":\"CVE-2021-47475\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.31\",\"versionEndExcluding\":\"4.4.292\",\"matchCriteriaId\":\"41FE03A0-D680-4E4E-86C7-020EEF6DCD99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"4.9.290\",\"matchCriteriaId\":\"85D8337A-4EA1-4787-85EA-4BF4328A9436\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.255\",\"matchCriteriaId\":\"436BD498-0DB1-4290-9A36-A52CB11B3AC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.217\",\"matchCriteriaId\":\"01C66D0E-2D4A-45A8-800F-23022B681325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.159\",\"matchCriteriaId\":\"A974BD5C-13A1-4974-B68A-6FD1422F5F3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.79\",\"matchCriteriaId\":\"AD6F772D-D9E4-4B9B-9E3C-CD5635E9E88D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.18\",\"matchCriteriaId\":\"B51F6469-3DD9-4E3B-8BD5-2E6911301BF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.2\",\"matchCriteriaId\":\"9BFCBC65-4DA5-4C88-B852-E7B052DE9F20\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T10:51:55+00:00",
      "cve": "CVE-2021-47475",
      "id": "CVE-2021-47475",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: comedi: vmk80xx: fix transfer-buffer overflows",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47475.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:37:52Z",
      "cve": "CVE-2021-47475",
      "id": "CVE-2021-47475",
      "initial_release_date": "2024-05-23T03:04:33Z",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "452",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47475",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47475.json",
      "version": "52"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.742Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47475\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T17:52:35.271810Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.588Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"comedi: vmk80xx: fix transfer-buffer overflows\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"5229159f1d052821007aff1a1beb7873eacf1a9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"ec85bcff4ed09260243d8f39faba99e1041718ba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"7a2021b896de1ad559d33b5c5cdd20b982242088\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"199acd8c110e3ae62833c24f632b0bb1c9f012a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"33d7a470730dfe7c9bfc8da84575cf2cedd60d00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"278484ae93297b1bb1ce755f9d3b6d95a48c7d47\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"06ac746d57e6d32b062e220415c607b7e2e0fa50\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"985cafccbf9b7f862aa1c5ee566801e18b5161fb\", \"lessThan\": \"a23461c47482fc232ffc9b819539d1f837adf2b1\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/comedi/drivers/vmk80xx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.31\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.31\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.4.292\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.*\"}, {\"status\": \"unaffected\", \"version\": \"4.9.290\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.255\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.217\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/comedi/drivers/vmk80xx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f\"}, {\"url\": \"https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba\"}, {\"url\": \"https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7\"}, {\"url\": \"https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088\"}, {\"url\": \"https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9\"}, {\"url\": \"https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00\"}, {\"url\": \"https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47\"}, {\"url\": \"https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50\"}, {\"url\": \"https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: vmk80xx: fix transfer-buffer overflows\\n\\nThe driver uses endpoint-sized USB transfer buffers but up until\\nrecently had no sanity checks on the sizes.\\n\\nCommit e1f13c879a7c (\\\"staging: comedi: check validity of wMaxPacketSize\\nof usb endpoints found\\\") inadvertently fixed NULL-pointer dereferences\\nwhen accessing the transfer buffers in case a malicious device has a\\nzero wMaxPacketSize.\\n\\nMake sure to allocate buffers large enough to handle also the other\\naccesses that are done without a size check (e.g. byte 18 in\\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\\nthe buffers, for example, when doing descriptor fuzzing.\\n\\nThe original driver was for a low-speed device with 8-byte buffers.\\nSupport was later added for a device that uses bulk transfers and is\\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.292\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.290\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.255\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.217\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.159\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.79\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.18\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.2\", \"versionStartIncluding\": \"2.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16\", \"versionStartIncluding\": \"2.6.31\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T13:55:24.292Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47475\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T13:55:24.292Z\", \"dateReserved\": \"2024-05-22T06:20:56.200Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T08:19:29.423Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.