Use-after-free in usbredir - CVE-2021-3700

Vulnerability identifier: #VU70660

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3700

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the usbredirparser_serialize() function in usbredirparser/usbredirparser.c. A local user can execute arbitrary code with elevated privileges.

usbredir
Ubuntu
openEuler
usbredirserver (Ubuntu package)
libusbredirhost1 (Ubuntu package)
libusbredirparser1 (Ubuntu package)
usbredir
usbredir-debuginfo
usbredir-devel
usbredir-debugsource
usbredir-help

Install updates from vendor's website.

usbredir - update to 0.11.0
usbredirserver (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 0.7.1-1ubuntu0.18.04.1, 0.8.0-1ubuntu0.1
libusbredirhost1 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 0.7.1-1ubuntu0.18.04.1, 0.8.0-1ubuntu0.1
libusbredirparser1 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 0.7.1-1ubuntu0.18.04.1, 0.8.0-1ubuntu0.1
usbredir - update to 0.8.0-5
usbredir-debuginfo - update to 0.8.0-5
usbredir-devel - update to 0.8.0-5
usbredir-debugsource - update to 0.8.0-5
usbredir-help - update to 0.8.0-5

• https://bugzilla.redhat.com/show_bug.cgi?id=1992830
• https://gitlab.freedesktop.org/spice/usbredir/-/commit/03c519ff5831ba
• https://lists.debian.org/debian-lts-announce/2022/03/msg00030.html

• Privilege escalation in usbredir
• Ubuntu update for usbredir
• openEuler update for usbredir