CVE-2021-3675

Published Jun 16, 2022

Last updated a year ago

CVSS high 7.1

Overview

Description: Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64; 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64; 5.2.2xx.26 versions prior to xx=29 on x86/64; 5.2.3xx.26 versions prior to xx=25 on x86/64; 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64; 5.5.xx.1058 versions prior to xx=44 on x86/64; 5.5.xx.1102 versions prior to xx=34 on x86/64; 5.5.xx.1116 versions prior to xx=14 on x86/64; 6.0.xx.1104 versions prior to xx=50 on x86/64; 6.0.xx.1108 versions prior to xx=31 on x86/64; 6.0.xx.1111 versions prior to xx=58 on x86/64.
Source: PSIRT@synaptics.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.1
Impact score: 5.2
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 3.6
Impact score: 4.9
Exploitability score: 3.9
Vector string: AV:L/AC:L/Au:N/C:P/I:N/A:P

Weaknesses

nvd@nist.gov: CWE-787
PSIRT@synaptics.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F38E1DD1-ECC6-43BC-A9B4-AB9132BB5E33",
            "versionEndExcluding": "5.1.340.26",
            "versionStartIncluding": "5.1.000.26"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F018DFB2-D2B8-40FD-B1BA-54B6796FC5DB",
            "versionEndExcluding": "5.2.3541.26",
            "versionStartIncluding": "5.2.0000.26"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FB516B80-AE5A-4B4D-87D2-AC891FAE552C",
            "versionEndExcluding": "5.2.229.26",
            "versionStartIncluding": "5.2.200.26"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4541B32F-5849-497B-8529-533115478160",
            "versionEndExcluding": "5.2.325.26",
            "versionStartIncluding": "5.2.300.26"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7D42006-84C4-450E-B180-BFEC5D5C98E1",
            "versionEndExcluding": "5.3.3543.26",
            "versionStartIncluding": "5.3.0000.26"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "22618553-5C06-487F-9F2A-E881DA0FC6A6",
            "versionEndExcluding": "5.5.44.1058",
            "versionStartIncluding": "5.5.00.1058"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0FB65743-59BE-4580-AC83-E0239BCEB492",
            "versionEndExcluding": "5.5.34.1102",
            "versionStartIncluding": "5.5.00.1102"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A26003EA-72D4-40CC-AFA9-E9A9AFA35673",
            "versionEndExcluding": "5.5.14.1116",
            "versionStartIncluding": "5.5.00.1116"
          },
          {
            "criteria": "cpe:2.3:a:synaptics:fingerprint_driver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A73E613F-C8BD-42EC-9797-34B4AD2EC280",
            "versionEndExcluding": "6.0.58.1111",
            "versionStartIncluding": "6.0.00.1111"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References