CVE-2021-47474

What it actually does

The vmk80xx comedi driver allocates endpoint-sized buffers for USB bulk transfers but assumes transmit and receive buffers are equal in size, allowing a malicious device to overflow the slab-allocated receive buffer.

Why it matters to the business

Systems using this driver face risk of kernel memory corruption from attached hardware, which can lead to crashes, denial of service, or potential code execution with physical or USB access.

How an attack unfolds

An attacker supplies a malicious USB device that reports unequal endpoint sizes; during normal bulk transfer operations the driver copies more data than the receive buffer holds, corrupting adjacent kernel memory.

How to fix it

Upgrade to a kernel containing the fix that properly validates buffer sizes before bulk transfers; apply the corrected driver code that no longer assumes equal tx/rx buffer lengths.

How to confirm the fix worked

Confirm the updated kernel or driver source contains the buffer-size check; verify that endpoint sizes are queried and respected separately for tx and rx paths.

Typical attack path

1. Attacker connects malicious USB device exposing vmk80xx interface
2. Device initiates bulk transfers with payload larger than the receive buffer
3. Driver performs unbounded copy into slab-allocated buffer
4. Memory corruption occurs enabling further exploitation or crash

How to detect it

Review kernel logs for slab allocation warnings or buffer overflow messages related to vmk80xx bulk transfers; inspect dmesg and USB device descriptors for unexpected endpoint size mismatches.

What your security team should do

• Apply the buffer-size fix in all kernels using the vmk80xx driver
• Restrict physical or USB access to systems running the vulnerable driver until patched
• Monitor for unexpected kernel oops or slab corruption on systems with comedi hardware