CVE-2021-47475: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47475 addresses a buffer overflow vulnerability in the vmk80xx module of the Linux kernel. The vulnerability was discovered in May 2024 and affects the comedi driver's handling of USB transfer buffers. The driver previously used endpoint-sized USB transfer buffers without proper sanity checks on the sizes (NVD, Red Hat).

The vulnerability stems from the vmk80xx driver's handling of USB transfer buffers. The driver uses endpoint-sized buffers but lacked proper size validation. A previous commit (e1f13c879a7c) inadvertently fixed NULL-pointer dereferences for cases with zero wMaxPacketSize, but other buffer access issues remained. The original driver was designed for a low-speed device with 8-byte buffers, and later support was added for a device using bulk transfers with a maximum 64-byte wMaxPacketSize (Kernel Commit).

Memory buffer allocations with incorrect sizes can result in an out-of-bounds write when performing descriptor fuzzing. This could potentially lead to memory corruption and system instability (Red Hat).

The vulnerability requires physical access to exploit, as it involves USB device interaction. The attack complexity is considered low, and it requires low privileges to execute. However, user interaction is not required for exploitation (Red Hat).

The vulnerability has been fixed by implementing proper buffer size checks and ensuring buffers are allocated with sufficient size to handle all accesses. A minimum buffer size of 64 bytes has been established to prevent buffer overflows. The fix involves modifying the vmk80xx_alloc_usb_buffers function to use the maximum of the endpoint's maximum packet size and the minimum buffer size (Kernel Commit).