Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects the comedi dt9812 USB driver. The driver used stack memory for USB transfer buffers, which can fail with DMA and may expose unintended stack data in some conditions. Business impact is limited unless affected systems use this driver, but kernel updates should be tracked through normal patch management.
Executive priority
Treat as routine kernel maintenance unless the organization uses the affected driver. Prioritize patching specialized Linux hosts connected to relevant USB data-acquisition hardware, while confirming exposure before emergency action.
Technical view
The dt9812 comedi driver allocated USB transfer buffers on the stack. The source says USB DMA buffers must not be stack allocated, and short transfers could cause the driver to act on random stack data. It also fixed a stack information leak on systems where DMA was not used, because 32 bytes were always sent to the device.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions where the comedi dt9812 driver is present and used. General Linux servers without this driver or relevant USB device use are less likely exposed. The bundle does not provide distribution-specific package names or configuration checks.
Exploitation context
The source bundle reports CVSS 5.3 and KEV is false. No cited source states active exploitation or public exploit availability. The described impact is low availability impact and possible stack information disclosure behavior tied to driver transfer handling.
Researcher notes
Evidence is limited to the CVE record and upstream stable commit references. The affected-version data in the bundle is broad and commit-oriented, so distribution-specific validation requires vendor advisories or local kernel changelogs.
Mitigation direction
- Update to a vendor kernel containing the relevant upstream stable fix.
- Check Linux distribution advisories for the corrected package version.
- Prioritize systems using the comedi dt9812 driver or related USB hardware.
- Use vendor guidance for any temporary workaround if patching is delayed.
Validation and detection
- Inventory Linux kernels against the affected version list in the CVE record.
- Confirm whether the comedi dt9812 driver is enabled, loaded, or required.
- Verify installed kernel includes one of the referenced stable commits or vendor backport.
- Review patch status through distribution security tooling or vendor advisories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-47477 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a6af69768d5cb4b2528946d53be5fa19ade37723CVE reference, Linux
- https://git.kernel.org/stable/c/365a346cda82f51d835c49136a00a9df8a78c7f2CVE reference, Linux
- https://git.kernel.org/stable/c/8a52bc480992c7c9da3ebfea456af731f50a4b97CVE reference, Linux
- https://git.kernel.org/stable/c/39ea61037ae78f14fa121228dd962ea3280eacf3CVE reference, Linux
- https://git.kernel.org/stable/c/3efb7af8ac437085b6c776e5b54830b149d86efeCVE reference, Linux
- https://git.kernel.org/stable/c/786f5b03450454557ff858a8bead5d7c0cbf78d6CVE reference, Linux
- https://git.kernel.org/stable/c/3ac273d154d634e2034508a14db82a95d7ad12edCVE reference, Linux
- https://git.kernel.org/stable/c/20cebb8b620dc987e55ddc46801de986e081757eCVE reference, Linux
- https://git.kernel.org/stable/c/536de747bc48262225889a533db6650731ab25d3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.