#VU90851 Input validation error in Linux kernel - CVE-2021-47476

Vulnerability identifier: #VU90851

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47476

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sizeof() and ni6501_find_endpoints() functions in drivers/staging/comedi/drivers/ni_usb6501.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/58478143771b20ab219937b1c30a706590a59224
https://git.kernel.org/stable/c/aa39738423503825625853b643b9e99d11c23816
https://git.kernel.org/stable/c/df7b1238f3b599a0b9284249772cdfd1ea83a632
https://git.kernel.org/stable/c/bc51111bf6e8e7b6cc94b133e4c291273a16acd1
https://git.kernel.org/stable/c/b0156b7c9649d8f55a2ce3d3258509f1b2a181c3
https://git.kernel.org/stable/c/ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1
https://git.kernel.org/stable/c/4a9d43cb5d5f39fa39fc1da438517004cc95f7ea
https://git.kernel.org/stable/c/d6a727a681a39ae4f73081a9bedb45d14f95bdd1
https://git.kernel.org/stable/c/907767da8f3a925b060c740e0b5c92ea7dbec440

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.