CVE-2021-21140 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Chrome

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources

Severity

6.8MEDIUMNVD

EPSS

0.1%

top 68.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Microsoft Edge

Timeline

PublishedFeb 9

Latest updateMay 24

Description

Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/chromeunspecified — 88.0.4324.96

▶NVDgoogle/chrome< 88.0.4324.96

▶NVDmicrosoft/edge< 88.0.705.74

▶Debianchromium/chromium< 88.0.4324.96-0.1+3

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-rcp2-2qxc-r85v: Uninitialized use in USB in Google Chrome prior to 88↗2022-05-24

▶

CVEList

CVE-2021-21140: Uninitialized use in USB in Google Chrome prior to 88↗2021-02-09

▶

OSV

CVE-2021-21140: Uninitialized use in USB in Google Chrome prior to 88↗2021-02-09

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2021-21138↗2021-01-19

▶

Microsoft

Chromium CVE-2021-21140: Uninitialized Use in USB↗2021-01-12

▶

Debian

CVE-2021-21140: chromium - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local ...↗2021

▶