CVE-2021-47476

What it actually does

Missing sanity checks on USB endpoint max-packet sizes allow zero-size pointer dereferences or buffer overflows in ni6501_port_command() and ni6501_counter_command() when a device reports smaller sizes than expected.

Why it matters to the business

Systems using the ni_usb6501 comedi driver may experience kernel crashes or memory corruption when attaching certain USB devices, potentially disrupting data acquisition hardware operations.

How an attack unfolds

An attacker supplies a malicious or fuzzed USB device whose descriptors report unexpectedly small max-packet sizes; during probe the driver allocates undersized buffers, and subsequent port or counter command paths dereference null pointers or overflow the transfer buffers.

How to fix it

Update the Linux kernel to a version containing the added sanity checks in probe(); for listed Ubuntu packages apply the corresponding fixes such as mysql-8.0 8.0.35-0ubuntu0.20.04.1 or 8.0.35-0ubuntu0.22.04.1 where applicable.

How to confirm the fix worked

Confirm the updated kernel source contains the size checks before allocating USB transfer buffers in the ni_usb6501 probe routine; verify loaded module version matches a fixed release.

Typical attack path

1. Attacker presents USB device with crafted max-packet sizes
2. Driver probe() omits size validation
3. ni6501_port_command() or ni6501_counter_command() receives invalid buffer lengths
4. NULL dereference or out-of-bounds write occurs in kernel context

How to detect it

Review kernel logs for USB or comedi driver oops messages mentioning ni6501 or NULL pointer dereferences during device enumeration; inspect dmesg and syslog for transfer buffer size anomalies.

What your security team should do

• Prioritize kernel updates on systems exposing the ni_usb6501 driver
• Restrict physical or USB access to affected hardware until patched
• Monitor for kernel oops or USB-related crashes as potential indicators