PT-2021-5716 · Google+2 · Google Chrome+2

Published 2021-11-15 · Updated 2024-06-15 · CVE-2021-38013

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 96.0.4664.45

Description The issue is caused by a heap buffer overflow in the fingerprint recognition function of Google Chrome. This can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The exploitation may also lead to a sandbox escape via a crafted HTML page if the WebUI renderer process has been compromised.

Recommendations For versions prior to 96.0.4664.45, update to version 96.0.4664.45 or later to resolve the issue. As a temporary workaround, consider restricting access to fingerprint recognition features in Google Chrome until the update is applied.

Exploit

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

ALT-PU-2021-3298

ALT-PU-2021-3329

ALT-PU-2021-3408

ALT-PU-2021-3431

ALT-PU-2021-3436

ALT-PU-2021-3583

ALT-PU-2021-3603

BDU:2022-00158

CVE-2021-38013

DSA-5046-1

OPENSUSE-SU-2021:1582-1

OPENSUSE-SU-2021:1632-1

OPENSUSE-SU-2021_1632-1

OPENSUSE-SU-2022:0047-1

OPENSUSE-SU-2022:0110-1

OPENSUSE-SU-2022_0047-1

OPENSUSE-SU-2022_0110-1

OPENSUSE-SU-2024:11687-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

Suse

References · 2347

• 🔥 https://crbug.com/1242392 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38013 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:0047-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11687-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1632-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38013 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/671376 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:0110-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38013 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-38013 · Vendor Advisory
• https://debian.org/security/2022/dsa-5046 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38013 · Vendor Advisory