CVE-2021-0874: PowerVR Kernel Driver Integer Overflow Vulnerability
Summary
CVE-2021-0874: In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2023-04-05. Fixed in SoCVersion:2023-04-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PowerVR kernel driver is an integral component of the Android ecosystem, responsible for managing graphics processing tasks. It enables efficient rendering and execution of graphics-related operations on devices powered by PowerVR technology. However, this driver has been identified to have a vulnerability that could lead to serious security implications, particularly concerning privilege escalation.
Vulnerability Detail
In the PVRSRVBridgeDevicememHistorySparseChange function of the PowerVR kernel driver, a missing size check can result in an integer overflow. This flaw may allow an attacker to access memory outside the intended bounds, leading to potential local escalation of privileges. The vulnerability does not require additional execution privileges or user interaction for exploitation, making it particularly dangerous.
How To Fix
Minimum fixed version
SoCVersion:2023-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been documented for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The CVE-2021-0874 vulnerability in the PowerVR kernel driver poses a significant risk due to its potential for local privilege escalation without user interaction. It is crucial for users to update to the patched version (SoCVersion 2023-04-05) to mitigate this risk effectively.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2021-0874 is a vulnerability in the PowerVR kernel driver that can lead to local privilege escalation due to an integer overflow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is local escalation of privileges, which could allow an attacker to gain unauthorized access to sensitive system resources.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
It is recommended to regularly check for updates and patches from your device manufacturer to ensure that you are protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
