CVE-2021-47476

comedi: ni_usb6501: fix NULL-deref in command paths

State: Published
Severity: 4.6 Medium
Published: May 22, 2024
Updated: May 11, 2026
Reserved: May 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

comedi: ni_usb6501: fix NULL-deref in command paths

The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing).

Add the missing sanity checks to probe().

Scores

CVSS	Score	Vector	Source
3.1	4.6 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	a03bb00e50ab4c07107da58a52a0bff7943f360c to before 58478143771b20ab219937b1c30a706590a59224Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before aa39738423503825625853b643b9e99d11c23816Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before df7b1238f3b599a0b9284249772cdfd1ea83a632Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before bc51111bf6e8e7b6cc94b133e4c291273a16acd1Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before b0156b7c9649d8f55a2ce3d3258509f1b2a181c3Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before 4a9d43cb5d5f39fa39fc1da438517004cc95f7eaAffected a03bb00e50ab4c07107da58a52a0bff7943f360c to before d6a727a681a39ae4f73081a9bedb45d14f95bdd1Affected a03bb00e50ab4c07107da58a52a0bff7943f360c to before 907767da8f3a925b060c740e0b5c92ea7dbec440Affected
LinuxLinux	3.18Affected before 3.18Not affected 4.4.292 through 4.4.Not affected 4.9.290 through 4.9.Not affected 4.14.255 through 4.14.Not affected 4.19.217 through 4.19.Not affected 5.4.159 through 5.4.Not affected 5.10.79 through 5.10.Not affected 5.14.18 through 5.14.Not affected 5.15.2 through 5.15.Not affected 5.16 and laterNot affected

Product

Versions

LinuxLinux

a03bb00e50ab4c07107da58a52a0bff7943f360c to before 58478143771b20ab219937b1c30a706590a59224Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before aa39738423503825625853b643b9e99d11c23816Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before df7b1238f3b599a0b9284249772cdfd1ea83a632Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before bc51111bf6e8e7b6cc94b133e4c291273a16acd1Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before b0156b7c9649d8f55a2ce3d3258509f1b2a181c3Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before 4a9d43cb5d5f39fa39fc1da438517004cc95f7eaAffected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before d6a727a681a39ae4f73081a9bedb45d14f95bdd1Affected
a03bb00e50ab4c07107da58a52a0bff7943f360c to before 907767da8f3a925b060c740e0b5c92ea7dbec440Affected

LinuxLinux

3.18Affected
before 3.18Not affected
4.4.292 through 4.4.*Not affected
4.9.290 through 4.9.*Not affected
4.14.255 through 4.14.*Not affected
4.19.217 through 4.19.*Not affected
5.4.159 through 5.4.*Not affected
5.10.79 through 5.10.*Not affected
5.14.18 through 5.14.*Not affected
5.15.2 through 5.15.*Not affected
5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.