CVE-2021-39685 — Out-of-bounds Write in Google Android

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer25 documents7 sources
Severity
7.8HIGHNVD
OSV7.0OSV6.5OSV4.7
EPSS
1.0%
top 22.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelDebian LinuxGoogle Android
Timeline
PublishedMar 16
Latest updateJul 13

Description

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Debianlinux/linux_kernel< 5.10.92-1+3
▶Ubuntulinux/linux_kernel< 4.15.0-169.177+1
▶debiandebian/linux< linux 5.15.5-2 (bookworm)

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

12
OSV
linux-aws vulnerabilities↗2022-07-13
▶
OSV
linux-lts-xenial, linux-kvm vulnerabilities↗2022-07-07
▶
OSV
linux-azure-5.13, linux-oracle-5.13 vulnerabilities↗2022-04-06
▶
OSV
linux, linux-aws, linux-aws-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oracle, linux-raspi vulnerabilities↗2022-03-22
▶
GHSA
GHSA-wf5m-qxcp-g2hf: In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check↗2022-03-17
▶

📋Vendor Advisories

12
Ubuntu
Linux kernel (AWS) vulnerabilities↗2022-07-13
▶
Ubuntu
Linux kernel vulnerabilities↗2022-07-07
▶
Ubuntu
Linux kernel vulnerabilities↗2022-04-06
▶
Ubuntu
Linux kernel vulnerabilities↗2022-03-22
▶
Android
CVE-2021-39685: Linux↗2022-03-01
▶
CVE-2021-39685 — Out-of-bounds Write in Google Android | cvebase