CVE-2020-0383: Heap Overflow in libsonivox - ASAN WRITE
Summary
CVE-2020-0383: In Parse_ins of eas_mdls.c, there is a possible out of bounds write due to a missing bounds check. Affects platform/external/sonivox across 4 version ranges.
>= 8.0:0, < 8.0:2020-09-01
>= 8.1:0, < 8.1:2020-09-01
>= 9:0, < 9:2020-09-01
>= 10:0, < 10:2020-09-01
Fixed in 8.0:2020-09-01 or 8.1:2020-09-01, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is libsonivox, which is a part of the Android ecosystem. It is responsible for media extraction processes. The vulnerability in question, identified as CVE-2020-0383, is a heap overflow issue present in the Parse_ins function of eas_mdls.c file. This vulnerability allows for potential out of bounds write, leading to remote information disclosure. It is important to note that this vulnerability does not require additional execution privileges and can be exploited with user interaction.
Vulnerability Detail
The vulnerability arises due to a missing bounds check in the Parse_ins function of eas_mdls.c. This allows an attacker to write beyond the allocated memory, potentially leading to remote information disclosure. The impact of this vulnerability is significant as it can expose sensitive information from the media extractor process. However, it does not grant any additional execution privileges to the attacker. Exploitation of this vulnerability requires user interaction.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0:0, < 8.0:2020-09-018.0:2020-09-01 -
>= 8.1:0, < 8.1:2020-09-018.1:2020-09-01
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the CVE-2020-0383 vulnerability in libsonivox poses a risk of remote information disclosure in the media extractor process. It is crucial to update the libsonivox package to the fixed version released on September 1, 2020, or a subsequent version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for platform/external/sonivox →
FAQ
This vulnerability allows for potential remote information disclosure in the media extractor process. However, it does not grant any additional execution privileges to the attacker.
Yes, user interaction is necessary for the successful exploitation of this vulnerability.
No, there are no known workarounds for this vulnerability.
This vulnerability affects Android versions 8.0 and above.
For more information, you can refer to the vulnerability details provided by the Android Open Source Project at https://storage.googleapis.com/android-osv/ASB-A-150160279.json.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/sonivox.
