PT-2021-7393 · Usbredir+5 · Usbredir+5

Hansmi + 1 · Published 2021-08-08 · Updated 2024-07-01 · CVE-2021-3700

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions usbredir versions prior to 0.11.0

Description A use-after-free issue was found in the usbredirparser serialize() function in usbredirparser/usbredirparser.c. This occurs when serializing large amounts of buffered write data, particularly in cases of slow or blocked destinations. The exploitation of this issue could allow an attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider disabling the usbredirparser serialize() function until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2021-3443

ALT-PU-2022-3084

ALT-PU-2023-4256

AZL-8824

BDU:2022-05968

CVE-2021-3700

DLA-2958-1

MGASA-2022-0133

OESA-2021-1355

OPENSUSE-SU-2024:11489-1

ROSA-SA-2024-2442

USN-5784-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Ubuntu

Usbredir

References · 31

• https://osv.dev/vulnerability/OESA-2021-1355 · Vendor Advisory
• https://gitlab.freedesktop.org/spice/usbredir/-/commit/03c519ff5831ba · Patch
• https://osv.dev/vulnerability/MGASA-2022-0133 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3700 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3700 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8824 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2958-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3700 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3700 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11489-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5784-1 · Vendor Advisory