QID 670955

The usbredir libraries allow USB devices to be used on remote and/or virtual hosts over TCP.The following libraries are provided: usbredirparser: A library containing the parser for the usbredir protocol usbredirhost: A library implementing the USB host side of a usbredir connection. All that an application wishing to implement a USB host needs to do is: * Provide a libusb device handle for the device * Provide write and read callbacks for the actual transport of usbredir data * Monitor for usbredir and libusb read/write events and call their handlers Security Fix(es): This use after free vulnerability is caused by serializing large amounts of write data. The pointer for a necessary buffer will briefly point to a location outside the buffer. During heavy load, or blocks the data is serialized. An attacker can not control the state while this is occurring. The attacker would also have to ensure that the write buffers are primed for this exploit to work. After the extensive setup, there is a small window of time where a possibly useful value could be written. Depending on the value written, this could lead to affects on Confidentiality, Integrity and Availability of the system.(CVE-2021-3700)
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.