CVE-2021-0650: Global-buffer-overflow in WT_InterpolateNoLoop in platform/external/sonivox
Summary
CVE-2021-0650: In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. Affects platform/external/sonivox across 3 version ranges.
>= 9:0, < 9:2021-11-01
>= 10:0, < 10:2021-11-01
>= 11:0, < 11:2021-11-01
Fixed in 9:2021-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'platform/external/sonivox' is a component of the Android ecosystem. It provides functionality related to MIDI extraction and manipulation. The package is vulnerable to a global buffer overflow in the WT_InterpolateNoLoop function of the eas_wtengine.c file. This vulnerability arises due to an incorrect bounds check, allowing for potential out-of-bounds reads. Exploitation of this vulnerability requires user interaction and can lead to remote information disclosure without requiring additional execution privileges.
Vulnerability Detail
The vulnerability (CVE-2021-0650) in WT_InterpolateNoLoop of eas_wtengine.c in platform/external/sonivox allows for a global buffer overflow. This occurs due to an incorrect bounds check, which enables out-of-bounds reads. An attacker can exploit this vulnerability to disclose remote information without the need for additional execution privileges. The exploitation requires user interaction, such as opening a malicious MIDI file. The impact of this vulnerability can be significant, as it may expose sensitive information to unauthorized parties.
How To Fix
Minimum fixed version
9:2021-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the 'platform/external/sonivox' package to a patched version.
Conclusion
The vulnerability (CVE-2021-0650) in the 'platform/external/sonivox' package allows for a global buffer overflow, potentially leading to remote information disclosure. To mitigate this vulnerability, it is crucial to update the package to a version that includes the necessary security patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/external/sonivox →
FAQ
This vulnerability can lead to remote information disclosure, potentially exposing sensitive data to unauthorized parties.
Yes, user interaction is needed for exploitation. Opening a malicious MIDI file is one way to trigger the vulnerability.
No, this vulnerability does not require additional execution privileges. An attacker can exploit it without elevated permissions.
Yes, versions 9, 10, and 11 of the 'platform/external/sonivox' package are affected by this vulnerability.
The fix for this vulnerability was released on November 1, 2021, as part of the updates for versions 9, 10, and 11 of the Android ecosystem.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/sonivox.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
