LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47475: comedi: vmk80xx: fix transfer-buffer overflows

In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-47475 is a Linux kernel bug in the comedi vmk80xx USB driver. A malformed or malicious USB device could cause the driver to use transfer buffers that are too small, risking memory corruption. This is not a typical internet-facing issue, but it matters for systems that accept untrusted USB devices.

Executive priority

Address during normal kernel patch cycles, with faster handling for devices exposed to untrusted USB peripherals. This is not currently supported as internet-exploited, but kernel memory corruption has meaningful impact where physical or peripheral access exists.

Technical view

The vmk80xx driver allocated USB transfer buffers based on endpoint packet sizes without sufficient sanity checks. Some code paths accessed fixed offsets, including byte 18 for VMK8061_MODEL, which could exceed smaller buffers during malicious descriptor handling or fuzzing. Linux stable commits add larger buffer allocation and endpoint validation fixes.

Likely exposure

Exposure is likely limited to Linux systems with the comedi vmk80xx driver present and reachable through attached USB hardware. Servers without USB device access or without this driver are less exposed. The source bundle does not provide package-specific distro ranges.

Exploitation context

The sources describe malicious USB descriptors and descriptor fuzzing as relevant contexts. They do not show public exploitation, remote exploitation, or inclusion in CISA KEV. Treat exploitation as local or physical USB-adjacent unless vendor advisories say otherwise.

Researcher notes

Evidence is strongest for the root cause and fix because the source bundle includes Linux stable commit references. Evidence is incomplete for CVSS, CWE, exploit availability, and distro-specific affected packages. Avoid asserting broader product impact without vendor advisories.

Mitigation direction

  • Update to a kernel build containing the referenced stable fixes.
  • Check Linux distribution advisories for exact fixed package versions.
  • Restrict untrusted USB devices on affected systems.
  • Disable or avoid loading the vmk80xx/comedi driver where not needed.
  • Prioritize shared workstations, labs, and embedded systems with USB exposure.

Validation and detection

  • Inventory kernels and loaded modules for comedi/vmk80xx usage.
  • Confirm distro kernel includes one of the referenced stable fixes.
  • Review USB device trust boundaries on affected hosts.
  • Check vulnerability scanner findings against actual driver presence.
  • Document systems where USB access is physically controlled.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47475 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fb, 985cafccbf9b7f862aa1c5ee566801e18b5161fbunaffected
LinuxLinux2.6.31, 0, 4.4.292, 4.9.290, 4.14.255, 4.19.217, 5.4.159, 5.10.79, 5.14.18, 5.15.2, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.