In the Linux kernel, the following vulnerability has been resolved:
comedi: ni_usb6501: fix NULL-deref in command paths
The driver uses endpoint-sized USB transfer buffers but had no sanity
checks on the sizes. This can lead to zero-size-pointer dereferences or
overflowed transfer buffers in ni6501_port_command() and
ni6501_counter_command() if a (malicious) device has smaller max-packet
sizes than expected (or when doing descriptor fuzz testing).
Add the missing sanity checks to probe().
Metrics
Affected Vendors & Products
References
History
Fri, 01 Nov 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
cvssV3_1
|
ssvc
|

Status: PUBLISHED
Assigner: Linux
Published: 2024-05-22T08:19:30.201Z
Updated: 2024-12-19T07:43:08.715Z
Reserved: 2024-05-22T06:20:56.200Z
Link: CVE-2021-47476

Updated: 2024-08-04T05:39:59.479Z

Status : Awaiting Analysis
Published: 2024-05-22T09:15:09.470
Modified: 2024-11-21T06:36:15.453
Link: CVE-2021-47476
