CVE-2021-0947: Android Unknown Package Heap Data Leak Vulnerability
Summary
CVE-2021-0947: The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM, and then copies the buffer to userspace. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2022-08-05. Fixed in SoCVersion:2022-08-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects an unknown package within the Android ecosystem, specifically related to the method PVRSRVBridgeTLDiscoverStreams. This method is responsible for managing stream discovery in the system, allocating memory on the heap for stream data. The package is integral to the functioning of certain hardware components and their interaction with the Android operating system.
Vulnerability Detail
The vulnerability arises from the method PVRSRVBridgeTLDiscoverStreams, which allocates memory for puiStreamsInt on the heap. When the method TLServerDiscoverStreamsKM is called, it may fail due to various reasons, such as invalid sizes. If this method fails, the allocated buffer remains uninitialized, yet the contents are still copied to userspace. This results in a kernel leak of uninitialized heap data, which can be exploited without requiring any privileges, potentially exposing sensitive information.
How To Fix
Minimum fixed version
SoCVersion:2022-08-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for updates and apply patches as they become available.
Conclusion
CVE-2021-0947 represents a significant vulnerability within an unknown Android package, allowing for the leak of uninitialized heap data. Users are strongly encouraged to update to the patched version to safeguard their systems against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2021-0947 is a vulnerability in an unknown Android package that allows for the kernel leak of uninitialized heap data.
This vulnerability can expose sensitive information by leaking uninitialized data from the kernel to userspace, potentially leading to data breaches.
If you are using a version of the affected package prior to SoCVersion:2022-08-05, your system may be at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If you cannot update the package, it is crucial to monitor your system for any unusual activity and consider additional security measures to protect sensitive data.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
