CVE-2021-38013: Heap buffer overflow in fingerprint recognition

Q: What is CVE-2021-38013?

CVE-2021-38013 is a vulnerability in the fingerprint recognition feature of Google Chrome on ChromeOS prior to version 96.0.4664.45.

Q: What is the severity of CVE-2021-38013?

The severity of CVE-2021-38013 is not specified in the provided information.

Q: How does CVE-2021-38013 work?

CVE-2021-38013 allows a remote attacker who has compromised a WebUI renderer process to potentially perform a sandbox escape through a crafted HTML page.

Q: Which software versions are affected by CVE-2021-38013?

CVE-2021-38013 affects Google Chrome on ChromeOS prior to version 96.0.4664.45.

Q: How can I fix CVE-2021-38013?

To fix CVE-2021-38013, update Google Chrome to version 96.0.4664.45 or later.

Published Aug 23, 2021

Updated

Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.

Credit

raven@@raid_akame

Affected Software

7 affected componentsFixes available

debian/chromium<=90.0.4430.212-1~deb10u1

116.0.5845.180-1~deb11u1118.0.5993.70-1~deb11u1116.0.5845.180-1~deb12u1118.0.5993.70-1~deb12u1118.0.5993.70-1

Google Chrome<96.0.4664.45

96.0.4664.45

Google Chrome<96.0.4664.45

Google Chrome OS

Fedoraproject Fedora=34

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Remediation

Patch Available

https://crbug.com/1242392

Event History

Aug 23, 2021

CVE Published

12:00 AM

Dec 23, 2021

CVE Published

via MITRE·12:05 AM

Data Sourced

via MITRE·12:05 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

2471449198019300311

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2021-38013?