Lucene search

[email protected]CVE-2021-3675

HistoryJun 16, 2022 - 5:15 p.m.

CVE-2021-3675

2022-06-1617:15:07

CWE-787

CWE-20

[email protected]

web.nvd.nist.gov

cve-2021-3675

input validation

vulnerability

synaptics

fingerprint driver

confidentiality

nvd

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64; 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64; 5.2.2xx.26 versions prior to xx=29 on x86/64; 5.2.3xx.26 versions prior to xx=25 on x86/64; 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64; 5.5.xx.1058 versions prior to xx=44 on x86/64; 5.5.xx.1102 versions prior to xx=34 on x86/64; 5.5.xx.1116 versions prior to xx=14 on x86/64; 6.0.xx.1104 versions prior to xx=50 on x86/64; 6.0.xx.1108 versions prior to xx=31 on x86/64; 6.0.xx.1111 versions prior to xx=58 on x86/64.

Affected configurations

NVD

Node

synapticsfingerprint_driverRange5.1.000.26–5.1.340.26

synapticsfingerprint_driverRange5.2.0000.26–5.2.3541.26

synapticsfingerprint_driverRange5.2.200.26–5.2.229.26

synapticsfingerprint_driverRange5.2.300.26–5.2.325.26

synapticsfingerprint_driverRange5.3.0000.26–5.3.3543.26

synapticsfingerprint_driverRange5.5.00.1058–5.5.44.1058

synapticsfingerprint_driverRange5.5.00.1102–5.5.34.1102

synapticsfingerprint_driverRange5.5.00.1116–5.5.14.1116

synapticsfingerprint_driverRange6.0.00.1111–6.0.58.1111

CPENameOperatorVersion
synaptics:fingerprint_driversynaptics fingerprint driverlt5.1.340.26
synaptics:fingerprint_driversynaptics fingerprint driverlt5.2.3541.26
synaptics:fingerprint_driversynaptics fingerprint driverlt5.2.229.26
synaptics:fingerprint_driversynaptics fingerprint driverlt5.2.325.26
synaptics:fingerprint_driversynaptics fingerprint driverlt5.3.3543.26
synaptics:fingerprint_driversynaptics fingerprint driverlt5.5.44.1058
synaptics:fingerprint_driversynaptics fingerprint driverlt5.5.34.1102
synaptics:fingerprint_driversynaptics fingerprint driverlt5.5.14.1116
synaptics:fingerprint_driversynaptics fingerprint driverlt6.0.58.1111

CPE	Name	Operator	Version
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.1.340.26
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.2.3541.26
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.2.229.26
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.2.325.26
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.3.3543.26
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.5.44.1058
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.5.34.1102
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	5.5.14.1116
synaptics:fingerprint_driver	synaptics fingerprint driver	lt	6.0.58.1111

CNA Affected

[
  {
    "platforms": [
      "x86/64"
    ],
    "product": "Synaptics Fingerprint Driver",
    "vendor": "Synaptics",
    "versions": [
      {
        "lessThan": "xxx=340",
        "status": "affected",
        "version": "5.1.xxx.26",
        "versionType": "custom"
      },
      {
        "lessThan": "xxxx=3541",
        "status": "affected",
        "version": "5.2.xxxx.26",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=29",
        "status": "affected",
        "version": "5.2.2xx.26",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=25",
        "status": "affected",
        "version": "5.2.3xx.26",
        "versionType": "custom"
      },
      {
        "lessThan": "xxxx=3543",
        "status": "affected",
        "version": "5.3.xxxx.26",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=44",
        "status": "affected",
        "version": "5.5.xx.1058",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=34",
        "status": "affected",
        "version": "5.5.xx.1102",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=14",
        "status": "affected",
        "version": "5.5.xx.1116",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=50",
        "status": "affected",
        "version": "6.0.xx.1104",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=31",
        "status": "affected",
        "version": "6.0.xx.1108",
        "versionType": "custom"
      },
      {
        "lessThan": "xx=58",
        "status": "affected",
        "version": "6.0.xx.1111",
        "versionType": "custom"
      }
    ]
  }
]

References

support.hp.com/us-en/document/ish_6411153-6411191-16/hpsbhf03797

support.lenovo.com/us/en/product_security/LEN-68054

synaptics.com/sites/default/files/2022-06/fingerprint-driver-SGX-security-brief-2022-06-14.pdf

Social References

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-3675

hp1 nvd1 prion1 cvelist1