CVE-2021-0509: Heap Use-After-Free in frameworks/av
Summary
CVE-2021-0509: In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. Affects platform/hardware/interfaces across 4 version ranges.
>= 8.1:0, < 8.1:2021-06-01
>= 9:0, < 9:2021-06-01
>= 10:0, < 10:2021-06-01
>= 11:0, < 11:2021-06-01
Fixed in 8.1:2021-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The frameworks/av package is a part of the Android ecosystem and is responsible for handling audio and video functionalities. It provides APIs and services for media playback, recording, and DRM (Digital Rights Management). The package is critical for the proper functioning of media-related applications on Android devices.
Vulnerability Detail
The vulnerability (CVE-2021-0509) exists in the CryptoPlugin.cpp file of the frameworks/av package. It is caused by a race condition that leads to a use-after-free scenario. This vulnerability can be exploited locally to escalate privileges without requiring additional execution privileges. It is important to note that user interaction is not necessary for the successful exploitation of this vulnerability.
How To Fix
Minimum fixed version
8.1:2021-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The CVE-2021-0509 vulnerability in the frameworks/av package of the Android ecosystem poses a risk of local privilege escalation. It is crucial to update the affected package to the fixed version released on June 1, 2021. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
This vulnerability can lead to local privilege escalation, allowing an attacker to gain elevated privileges on the affected Android device.
No, user interaction is not needed for the successful exploitation of this vulnerability.
This vulnerability affects Android versions 8.1, 9, 10, and 11.
Yes, a fix for this vulnerability was released on June 1, 2021.
You can find more information about this vulnerability in the official Android Open Source Project (AOSP) security bulletin: https://storage.googleapis.com/android-osv/ASB-A-176444161.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
