CVE-2021-39667: Heap-buffer-overflow in libavc:avc_dec_fuzzer
Summary
CVE-2021-39667: In ih264d_parse_decode_slice of ih264d_parse_slice.c, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/external/libavc across 4 version ranges.
>= 10:0, < 10:2022-03-01
>= 11:0, < 11:2022-03-01
>= 12:0, < 12:2022-03-01
>= 12L:0, < 12L:2022-03-01
Fixed in 10:2022-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is libavc, an external library used in the Android ecosystem. It is responsible for handling AVC (Advanced Video Coding) decoding functionality. This vulnerability affects versions 10, 11, 12, and 12L of the Android platform. The library is susceptible to a heap buffer overflow in the ih264d_parse_decode_slice function of ih264d_parse_slice.c.
Vulnerability Detail
The vulnerability arises due to a possible out-of-bounds write, leading to a heap buffer overflow. Exploitation of this vulnerability could result in remote information disclosure without requiring additional execution privileges. However, user interaction is necessary for successful exploitation.
How To Fix
Minimum fixed version
10:2022-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the libavc library in the Android ecosystem is vulnerable to a heap buffer overflow. This vulnerability could lead to remote information disclosure, but it requires user interaction for exploitation. Developers should update their libavc library to the fixed version to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/external/libavc →
FAQ
The vulnerability could lead to remote information disclosure, potentially exposing sensitive data.
Versions 10, 11, 12, and 12L of the Android platform are affected.
Yes, user interaction is necessary for successful exploitation of this vulnerability.
The recommended mitigation is to update the libavc library to the fixed version.
You can find more information about this vulnerability in the Android Open Source Project Security Bulletin: ASB-A-205702093.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/libavc.
