CVE-2021-39685

Published on: Not Yet Published

Last Modified on: 03/23/2022 04:20:00 PM UTC

CVE-2021-39685

Source: Mitre Source: NIST CVE.ORG Print: PDF PDF
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Certain versions of Android from Google contain the following vulnerability:

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel

  • CVE-2021-39685 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 7.8 - HIGH

Attack
Vector ⓘ		 Attack
Complexity		 Privileges
Required		 User
Interaction
LOCAL LOW LOW NONE
Scope Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 7.2 - HIGH

Access
Vector ⓘ		 Access
Complexity		 Authentication
LOCAL LOW NONE
Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
COMPLETE COMPLETE COMPLETE

CVE References

Description Tags ⓘ Link
Android Security Bulletin—March 2022  |  Android Open Source Project source.android.com
text/html
 URL Logo MISC source.android.com/security/bulletin/2022-03-01
By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

  • 159727 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2022-9245)
  • 159729 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2022-9244)
  • 179012 Debian Security Update for linux (DSA 5050-1)
  • 179117 Debian Security Update for linux (DSA 5096-1)
  • 179118 Debian Security Update for linux (DLA 2940-1)
  • 179119 Debian Security Update for linux-4.19 (DLA 2941-1)
  • 198659 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5278-1)
  • 198667 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5294-1)
  • 198674 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5294-2)
  • 198676 Ubuntu Security Notification for Linux kernel (GKE) Vulnerabilities (USN-5297-1)
  • 198678 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5298-1)
  • 198708 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5337-1)
  • 198731 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5368-1)
  • 353242 Amazon Linux Security Advisory for kernel : ALAC2012-2022-036
  • 353243 Amazon Linux Security Advisory for kmod-mlx5 : ALAC2012-2022-037
  • 353244 Amazon Linux Security Advisory for kmod-sfc : ALAC2012-2022-038
  • 376925 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2022:0125)
  • 610401 Google Android Devices March 2022 Security Patch Missing
  • 610408 Google Android April 2022 Security Patch Missing for Huawei EMUI
  • 610409 Google Android April 2022 Security Patch Missing for Samsung
  • 671448 EulerOS Security Update for kernel (EulerOS-SA-2022-1450)
  • 671474 EulerOS Security Update for kernel (EulerOS-SA-2022-1429)
  • 671505 EulerOS Security Update for kernel (EulerOS-SA-2022-1489)
  • 671535 EulerOS Security Update for kernel (EulerOS-SA-2022-1508)
  • 751700 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0363-1)
  • 751704 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2022:0370-1)
  • 752005 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0370-1)
  • 753172 SUSE Enterprise Linux Security Update for the Linux RT Kernel (SUSE-SU-2022:0543-1)
  • 753212 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2022:0363-1)

Exploit/POC from Github

CVE-2021-39685 Description and sample exploit for Linux USB Gadget overflow vulnerability

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System		GoogleAndroid-AllAllAll
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
Twitter Icon @buaqbot Exploit for CVE-2021-39685 exploit ift.tt/3yrJZsA ift.tt/3DZaZAE 2021-12-16 00:05:19
Twitter Icon @jedisct1 CVE-2021-39685 : Linux Kernel USB Gadget buffer overflow openwall.com/lists/oss-secu… 2021-12-18 04:17:06
Twitter Icon @management_sun IT Risk: Debian.Multiple vulnerabilities in the linux kernel -2/2 CVE-2021-39685 CVE-2021-28715 CVE-2021-28714 CVE-… twitter.com/i/web/status/1… 2022-01-21 03:39:51
Twitter Icon @softek_jp Linux Kernel の USB gadget の処理に特権を奪われる問題 (CVE-2021-39685) [41117] sid.softek.jp/content/show/4… #SIDfm #脆弱性情報 2022-01-24 06:04:27
Twitter Icon @management_sun IT Risk: Ubuntu.Linux kernel (OEM)に複数の脆弱性 -2/2 CVE-2021-39685 CVE-2021-4001 CVE-2021-4083 CVE-2021-4135 CVE-2021-41… twitter.com/i/web/status/1… 2022-02-09 11:40:41
Twitter Icon @CVEreport cve.report/CVE-2021-39685 In various setup methods of the USB gadget subsystem, there is a possible out of bounds wr… twitter.com/i/web/status/1… 2022-03-16 16:20:14
Reddit Logo Icon /r/k12cybersecurity MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Google Android OS and Pixel Could Allow for Remote Code Execution - PATCH: NOW 2022-03-08 22:01:38
Reddit Logo Icon /r/netcve CVE-2021-39685 2022-03-16 17:38:44
Reddit Logo Icon /r/GalaxyS22 Samsung April 2022 Security Patch Details 2022-04-05 06:51:02
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report