https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 19:32:09 +0000 https://vulnerability.circl.lu/vuln/cve-2021-47475 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: vmk80xx: fix transfer-buffer overflows</p> <p>The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes.</p> <p>Commit e1f13c879a7c (&#34;staging: comedi: check validity of wMaxPacketSize of usb endpoints found&#34;) inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize.</p> <p>Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing.</p> <p>The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>comedi: vmk80xx: fix transfer-buffer overflows</p> <p>The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes.</p> <p>Commit e1f13c879a7c (&#34;staging: comedi: check validity of wMaxPacketSize of usb endpoints found&#34;) inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize.</p> <p>Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing.</p> <p>The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize.</p> https://vulnerability.circl.lu/vuln/cve-2021-47475