Log in Start free

Vulnerability · Published May 22, 2024 · Assigned by Linux

CVE-2021-47477comedi: dt9812: fix DMA buffers on stack

Medium 5.3

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: comedi: dt9812: fix DMA buffers on stack USB transfer buffers are typically mapped for DMA and must not be allocated on the stack or transfers will fail. Allocate proper transfer buffers in the various command helpers and return an error on short transfers instead of acting on random stack data. Note that this also fixes a stack info leak on systems where DMA is not used as 32 bytes are always sent to the device regardless of how short the command is.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.15.3-1DEBIAN-CVE-2021-47477
Debian:13linux5.15.3-1DEBIAN-CVE-2021-47477
Debian:14linux5.15.3-1DEBIAN-CVE-2021-47477
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-47477
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-47477
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-47477

Affected products (as reported)

VendorProductVersions
Linux Linux 63274cd7d38a3322d90b66a5bc976de1fb899051 – before a6af69768d5cb4b2528946d53be5fa19ade3772363274cd7d38a3322d90b66a5bc976de1fb899051 – before 365a346cda82f51d835c49136a00a9df8a78c7f263274cd7d38a3322d90b66a5bc976de1fb899051 – before 8a52bc480992c7c9da3ebfea456af731f50a4b9763274cd7d38a3322d90b66a5bc976de1fb899051 – before 39ea61037ae78f14fa121228dd962ea3280eacf363274cd7d38a3322d90b66a5bc976de1fb899051 – before 3efb7af8ac437085b6c776e5b54830b149d86efe63274cd7d38a3322d90b66a5bc976de1fb899051 – before 786f5b03450454557ff858a8bead5d7c0cbf78d663274cd7d38a3322d90b66a5bc976de1fb899051 – before 3ac273d154d634e2034508a14db82a95d7ad12ed63274cd7d38a3322d90b66a5bc976de1fb899051 – before 20cebb8b620dc987e55ddc46801de986e081757e
Linux Linux 2.6.29

References