CVE-2021-47475

What it actually does

Buffer overflows in USB transfer buffers of the vmk80xx comedi driver due to missing size sanity checks on endpoint wMaxPacketSize and other unchecked accesses (e.g., byte 18 in vmk80xx_cnt_insn_read for VMK8061_MODEL), allowing writes beyond allocated buffers when handling low-speed or full-speed devices or during descriptor fuzzing.

Why it matters to the business

Potential kernel crashes, denial of service, or privilege escalation on Linux systems using affected USB hardware, leading to operational downtime, data integrity issues, and increased security risk in environments relying on comedi drivers.

How an attack unfolds

An attacker supplies a malicious USB device with crafted descriptors (zero or oversized wMaxPacketSize, or bulk endpoints) that the driver accepts without validation; subsequent comedi operations trigger out-of-bounds writes into undersized transfer buffers, enabling memory corruption.

How to fix it

Upgrade affected packages to the listed fixed versions: mysql-8.0 on Ubuntu 20.04 to 8.0.32-0buntu0.20.04.1 and mysql-5.7 on Ubuntu Pro 16.04 to 5.7.44-0ubuntu0.16.04.1+esm1 (or equivalent kernel patches addressing the vmk80xx buffer handling). Apply vendor updates promptly given the 880 days since publication.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases; confirm kernel logs no longer show vmk80xx buffer-related warnings and test with representative USB devices to ensure no overflow conditions trigger.

Typical attack path

1. Attacker connects malicious USB device reporting specific endpoint sizes
2. Driver allocates undersized transfer buffers without full sanity checks
3. Comedi instruction handlers perform unchecked accesses (e.g., byte 18)
4. Out-of-bounds write occurs, leading to corruption or crash

How to detect it

Review kernel logs for vmk80xx or comedi buffer allocation errors, USB descriptor parsing anomalies, or crashes during device enumeration; check for unexpected device connections in auditd or udev logs.

What your security team should do

• Prioritize patching systems with comedi/vmk80xx usage due to buffer overflow risk
• Monitor EPSS and exploit maturity; no known KEV or ransomware use but still address
• Restrict physical USB access where possible until updates are applied
• Audit downstream package dependencies for prevalence impact