In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/06ac746d57e6d32b062e220415c607b7e2e0fa50 cve-icon cve-icon
https://git.kernel.org/stable/c/199acd8c110e3ae62833c24f632b0bb1c9f012a9 cve-icon cve-icon
https://git.kernel.org/stable/c/278484ae93297b1bb1ce755f9d3b6d95a48c7d47 cve-icon cve-icon
https://git.kernel.org/stable/c/33d7a470730dfe7c9bfc8da84575cf2cedd60d00 cve-icon cve-icon
https://git.kernel.org/stable/c/40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7 cve-icon cve-icon
https://git.kernel.org/stable/c/5229159f1d052821007aff1a1beb7873eacf1a9f cve-icon cve-icon
https://git.kernel.org/stable/c/7a2021b896de1ad559d33b5c5cdd20b982242088 cve-icon cve-icon
https://git.kernel.org/stable/c/a23461c47482fc232ffc9b819539d1f837adf2b1 cve-icon cve-icon
https://git.kernel.org/stable/c/ec85bcff4ed09260243d8f39faba99e1041718ba cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052236-CVE-2021-47475-6524@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-47475 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-47475 cve-icon
History

Wed, 24 Sep 2025 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 04 Nov 2024 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-22T08:19:29.423Z

Updated: 2025-05-04T07:11:43.980Z

Reserved: 2024-05-22T06:20:56.200Z

Link: CVE-2021-47475

cve-icon Vulnrichment

Updated: 2024-08-04T05:39:59.742Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-22T09:15:09.370

Modified: 2025-09-24T18:58:58.467

Link: CVE-2021-47475

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-05-22T00:00:00Z

Links: CVE-2021-47475 - Bugzilla