Vulnerability in comedi: vmk80xx
Summary
GSD-2021-1001972: comedi: vmk80xx: fix transfer-buffer overflows. Affects Kernel versions >= 985cafccbf9b7f862aa1c5ee566801e18b5161fb, < 40d2a7e278e2e7c0a5fd7e997e7eb63945bf93f7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The comedi package is a Linux kernel module that provides a unified interface for data acquisition and control from a variety of devices. It allows users to interact with different hardware devices through a common API. The vmk80xx module within comedi is responsible for handling data transfer operations for the VMK-80xx series of devices. These devices are used for voltage measurement and control in various industrial applications.
Vulnerability Detail
The vmk80xx module in the comedi package is susceptible to transfer-buffer overflows. This vulnerability can be exploited by an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or system crashes. The issue was introduced in version v2.6.31 of the Linux Kernel and has been fixed in version v4.14.255.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable or remove the vmk80xx module from the comedi package if it is not required for their system. This can be done by executing the following commands as root:
- Disable the module:
echo 'blacklist vmk80xx' >> /etc/modprobe.d/blacklist.conf - Remove the module:
rmmod vmk80xx
Conclusion
In conclusion, the comedi: vmk80xx vulnerability in the Linux Kernel can be exploited to trigger transfer-buffer overflows, potentially leading to arbitrary code execution or system crashes. It is crucial to update the kernel to version v4.14.255 or later to mitigate this vulnerability. Alternatively, users can disable or remove the vmk80xx module if it is not required for their system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The comedi package is a Linux kernel module that provides a unified interface for data acquisition and control from various devices.
The vmk80xx module is a component of the comedi package responsible for handling data transfer operations for the VMK-80xx series of devices used for voltage measurement and control.
A transfer-buffer overflow occurs when data is written beyond the boundaries of a buffer, potentially overwriting adjacent memory locations. This can lead to various security issues, including arbitrary code execution or system crashes.
This vulnerability could allow an attacker to execute arbitrary code or cause system crashes, potentially leading to a denial of service or unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
