CVE-2021-0436: Information Leak in libdrmclearkeyplugin.so in CryptoPlugin.cpp
Summary
CVE-2021-0436: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. Affects platform/hardware/interfaces across 4 version ranges.
>= 8.1:0, < 8.1:2021-04-01
>= 9:0, < 9:2021-04-01
>= 10:0, < 10:2021-04-01
>= 11:0, < 11:2021-04-01
Fixed in 8.1:2021-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is platform/frameworks/av in the Android ecosystem. It is responsible for providing audio and video functionality to the Android operating system. The vulnerability affects the CryptoPlugin.cpp file in the libdrmclearkeyplugin.so library. This library is used for DRM (Digital Rights Management) decryption. The vulnerability allows for an out of bounds read due to an integer overflow, potentially leading to local information disclosure. This vulnerability does not require any additional execution privileges and does not rely on user interaction for exploitation.
Vulnerability Detail
The vulnerability exists in the CryptoPlugin::decrypt function of CryptoPlugin.cpp. An integer overflow occurs, leading to an out of bounds read. This can result in the disclosure of sensitive information stored in memory. The impact of this vulnerability is limited to local information disclosure, and it does not grant additional execution privileges. The vulnerability affects Android versions 8.1 and above.
How To Fix
Minimum fixed version
8.1:2021-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability CVE-2021-0436 in the CryptoPlugin.cpp file of the libdrmclearkeyplugin.so library can lead to local information disclosure. It is recommended to update the affected package to the fixed version and keep the Android operating system up to date with the latest security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
The impact of this vulnerability is limited to local information disclosure. It does not grant additional execution privileges.
No, this vulnerability does not require user interaction for exploitation.
Android versions 8.1 and above are affected by this vulnerability.
Yes, a fix is available for the affected package. Please refer to the 'how_to_fix' section for more details.
No specific workarounds have been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
