CVE-2021-47477

What it actually does

USB transfer buffers allocated on the stack in the comedi dt9812 driver cause DMA mapping failures and allow 32 bytes of kernel stack data to be sent to the device on short transfers, resulting in information disclosure.

Why it matters to the business

Systems using the affected Linux kernel driver with dt9812 hardware risk exposure of kernel memory contents to connected USB devices; the flaw is present in many distributions but has low exploitation probability and no known in-the-wild use.

How an attack unfolds

An attacker with the ability to trigger comedi dt9812 command helpers sends short USB transfers; the driver transmits uninitialized stack contents instead of the intended buffer, leaking kernel data to the device.

How to fix it

Upgrade the Linux kernel to a version containing commit that allocates DMA-safe buffers in dt9812 command helpers; for the listed Ubuntu packages apply the referenced mysql-8.0 updates if they include the kernel fix, or install the corrected kernel package directly.

How to confirm the fix worked

Confirm the dt9812 driver source no longer places USB buffers on the stack and that short transfers return errors instead of acting on stack data; verify the running kernel version matches or exceeds the fixed release.

Typical attack path

1. Identify system with comedi dt9812 USB hardware and vulnerable kernel
2. Load or trigger the dt9812 comedi driver command paths
3. Issue short USB control or data transfers to the device
4. Observe or capture the 32 bytes of stack data sent by the driver

How to detect it

Review kernel logs for dt9812 USB transfer errors, inspect USB traffic captures for unexpected 32-byte payloads from the driver, and search system call traces involving comedi commands on dt9812 hardware.

What your security team should do

• Apply the kernel fix for CVE-2021-47477 immediately on any system exposing dt9812 hardware
• Audit for presence of comedi dt9812 devices and disable the driver if not required
• Monitor EPSS and KEV status for any future increase in exploit maturity