CVE-2021-3675: Synaptics Fingerprint Privilege Escalation

CVE-2021-3675 Overview

CVE-2021-3675 is an Improper Input Validation vulnerability in the synaTEE.signed.dll component of the Synaptics Fingerprint Driver. This vulnerability allows a local authorized attacker to overwrite a heap tag, potentially resulting in loss of confidentiality and system availability. The flaw exists within the trusted execution environment (TEE) component of the fingerprint driver, which handles sensitive biometric authentication data.

Critical Impact

A local attacker with low privileges can exploit this heap corruption vulnerability to access confidential biometric data or cause denial of service on affected systems running Synaptics Fingerprint Driver.

Affected Products

• Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64
• Synaptics Fingerprint Driver 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64
• Synaptics Fingerprint Driver 5.2.2xx.26 versions prior to xx=29 on x86/64
• Synaptics Fingerprint Driver 5.2.3xx.26 versions prior to xx=25 on x86/64
• Synaptics Fingerprint Driver 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64
• Synaptics Fingerprint Driver 5.5.xx.1058 versions prior to xx=44 on x86/64
• Synaptics Fingerprint Driver 5.5.xx.1102 versions prior to xx=34 on x86/64
• Synaptics Fingerprint Driver 5.5.xx.1116 versions prior to xx=14 on x86/64
• Synaptics Fingerprint Driver 6.0.xx.1104 versions prior to xx=50 on x86/64
• Synaptics Fingerprint Driver 6.0.xx.1108 versions prior to xx=31 on x86/64
• Synaptics Fingerprint Driver 6.0.xx.1111 versions prior to xx=58 on x86/64

Discovery Timeline

• 2022-06-16 - CVE-2021-3675 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3675

Vulnerability Analysis

This vulnerability stems from improper input validation within the synaTEE.signed.dll library, a critical component of the Synaptics Fingerprint Driver that operates within Intel Software Guard Extensions (SGX) enclaves. The SGX technology is designed to provide hardware-based memory encryption and isolation for sensitive operations, including biometric data processing. However, the failure to properly validate input parameters before processing allows an attacker to corrupt heap memory structures.

The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-787 (Out-of-bounds Write), indicating that insufficient validation of input data allows memory corruption beyond intended boundaries. This type of vulnerability in a signed driver component is particularly concerning as drivers operate with elevated privileges on Windows systems.

Root Cause

The root cause of CVE-2021-3675 lies in the insufficient validation of user-supplied input within the synaTEE.signed.dll library. When processing data related to fingerprint authentication operations, the driver fails to properly validate input boundaries before performing heap memory operations. This allows specially crafted input to overwrite heap metadata (specifically heap tags), corrupting the memory management structures used by the driver.

The vulnerability affects the TEE component, which is intended to be a secure execution environment. The failure to validate inputs at this trust boundary means that even though the code is signed and operates within SGX enclaves, a local attacker with user-level access can manipulate the heap state through improper input.

Attack Vector

The attack requires local access to the affected system with at least user-level privileges. An attacker can exploit this vulnerability by:

1. Identifying a system with a vulnerable version of the Synaptics Fingerprint Driver installed
2. Crafting malicious input that triggers the improper validation path in synaTEE.signed.dll
3. Submitting the crafted input through legitimate driver interfaces
4. Corrupting heap tags to either read confidential data from memory or cause a denial of service condition

The vulnerability mechanism involves heap metadata corruption through malformed input to the fingerprint driver's TEE component. When the driver processes authentication-related data without proper bounds checking, an attacker can overwrite critical heap structures. For detailed technical analysis, refer to the Synaptics Security Brief.

Detection Methods for CVE-2021-3675

Indicators of Compromise

• Unexpected crashes or instability in the Synaptics Fingerprint Driver or associated Windows services
• Abnormal memory access patterns or heap corruption errors in system event logs referencing synaTEE.signed.dll
• Suspicious processes attempting to interact with the fingerprint driver outside of normal authentication workflows
• Application crash dumps showing heap corruption within Synaptics driver components

Detection Strategies

• Monitor system event logs for driver crashes or heap corruption events associated with Synaptics fingerprint components
• Implement endpoint detection rules to identify unusual access patterns to synaTEE.signed.dll or related driver files
• Deploy file integrity monitoring on Synaptics driver directories to detect unauthorized modifications
• Use memory protection solutions to detect heap corruption attempts in kernel-mode drivers

Monitoring Recommendations

• Configure Windows Event Log monitoring for Application and System events related to Synaptics driver failures
• Implement SentinelOne's behavioral AI to detect anomalous driver interactions and memory corruption attempts
• Enable enhanced process monitoring for applications that interact with biometric authentication subsystems
• Review driver version inventories regularly to identify systems running vulnerable Synaptics Fingerprint Driver versions

How to Mitigate CVE-2021-3675

Immediate Actions Required

• Inventory all systems with Synaptics Fingerprint Drivers and identify vulnerable versions
• Apply vendor-provided driver updates from your device manufacturer (HP, Lenovo, or others)
• Restrict local access to systems with biometric authentication until patches are applied
• Consider temporarily disabling fingerprint authentication on critical systems if patching is delayed

Patch Information

Synaptics has released updated versions of the Fingerprint Driver to address this vulnerability. Users should update to the following minimum versions based on their current driver branch:

• Version 5.1.340.26 or later for the 5.1.x branch
• Version 5.2.3541.26 or later for the 5.2.x branch
• Version 5.3.3543.26 or later for the 5.3.x branch
• Version 5.5.44.1058, 5.5.34.1102, or 5.5.14.1116 or later for the 5.5.x branches
• Version 6.0.50.1104, 6.0.31.1108, or 6.0.58.1111 or later for the 6.0.x branches

For manufacturer-specific guidance, refer to the HP Security Bulletin or Lenovo Security Advisory.

Workarounds

• Disable fingerprint authentication temporarily and use alternative authentication methods such as PIN or password
• Restrict local user access to systems with vulnerable drivers to only trusted users
• Implement network segmentation to limit lateral movement from potentially compromised endpoints
• Enable additional endpoint protection controls to detect memory corruption exploitation attempts

# Check installed Synaptics driver version (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like "*Synaptics*fingerprint*"} | Select-Object DeviceName, DriverVersion

# Disable fingerprint authentication service temporarily (run as Administrator)
Stop-Service -Name "WbioSrvc" -Force
Set-Service -Name "WbioSrvc" -StartupType Disabled