NetSight
IP …
medium4.6

CVE-2021-47476

In the Linux kernel, the following vulnerability has been resolved: comedi: ni_usb6501: fix NULL-deref in command paths The driver uses endpoint-sized USB tran…

Impact

In the Linux kernel, the following vulnerability has been resolved: comedi: ni_usb6501: fix NULL-deref in command paths The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe().

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.18 before 4.4.292
from 4.5 before 4.9.290
from 4.10 before 4.14.255
from 4.15 before 4.19.217
from 4.20 before 5.4.159
from 5.5 before 5.10.79

Weakness classification

CWE-476

References