CVE-2021-47477 – This CVE describes a kernel vulnerability in th... (How to Fix)

📋 TL;DR

This CVE describes a kernel vulnerability in the comedi dt9812 driver where USB transfer buffers were allocated on the stack instead of proper DMA buffers. This could allow attackers to cause kernel crashes or potentially leak sensitive kernel stack data. Systems using the comedi subsystem with dt9812 hardware are affected.

💻 Affected Systems

Products:

Linux kernel with comedi dt9812 driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when comedi subsystem is loaded and dt9812 hardware is present/used

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential information disclosure of kernel stack memory containing sensitive data

🟠

Likely Case

System instability, USB communication failures with dt9812 devices, or kernel crashes when using affected hardware

🟢

If Mitigated

Minimal impact if proper kernel hardening and access controls prevent unauthorized users from accessing comedi devices

🌐 Internet-Facing: LOW - This requires local access to the comedi subsystem and specific hardware

🏢 Internal Only: MEDIUM - Local attackers with access to comedi devices could exploit this to cause denial of service

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to interact with comedi devices; not a remote vulnerability

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 20cebb8b620dc987e55ddc46801de986e081757e, 365a346cda82f51d835c49136a00a9df8a78c7f2, 39ea61037ae78f14fa121228dd962ea3280eacf3, 3ac273d154d634e2034508a14db82a95d7ad12ed, 3efb7af8ac437085b6c776e5b54830b149d86efe

Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits
2. Reboot system to load new kernel
3. Verify comedi module loads properly

🔧 Temporary Workarounds

Disable comedi dt9812 module

linux

Prevent loading of vulnerable driver module

echo 'blacklist dt9812' >> /etc/modprobe.d/blacklist.conf
rmmod dt9812

Restrict comedi device access

linux

Limit access to comedi devices to trusted users only

chmod 600 /dev/comedi*
chown root:root /dev/comedi*

🧯 If You Can't Patch

Restrict physical and local access to systems with dt9812 hardware
Implement strict access controls for users who can interact with comedi devices

🔍 How to Verify

Check if Vulnerable:

Check if dt9812 module is loaded: lsmod | grep dt9812
Check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits, test dt9812 device functionality

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
USB transfer failures in kernel logs
Comedi driver errors

Network Indicators:

None - local vulnerability only

SIEM Query:

kernel: "dt9812" OR "comedi" AND ("DMA" OR "stack" OR "buffer")

📊 Metadata

CVE ID: CVE-2021-47477

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 22, 2024

Last Updated: September 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-47477, you might also want to check these: