CVE-2021-39804: Null Pointer Dereference Vulnerability in platform/frameworks/av
Summary
CVE-2021-39804: In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. Affects platform/frameworks/av across 3 version ranges.
>= 11:0, < 11:2022-04-01
>= 12:0, < 12:2022-04-01
>= 12L:0, < 12L:2022-04-01
Fixed in 11:2022-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/av package is a part of the Android ecosystem and is responsible for handling audio and video functionalities. It provides APIs and components for media playback, recording, and processing. This package is crucial for various multimedia applications on Android devices.
Vulnerability Detail
The vulnerability (CVE-2021-39804) exists in the HeifDecoderImpl.cpp file of the platform/frameworks/av package. During the reinit process, a null check is missing, leading to a possible crash. Exploiting this vulnerability could result in a remote persistent denial of service (DoS) attack. The attack can be triggered through the file picker, and it does not require any additional execution privileges. However, user interaction is necessary for successful exploitation.
How To Fix
Minimum fixed version
11:2022-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
The null pointer dereference vulnerability in platform/frameworks/av (CVE-2021-39804) can lead to a remote denial of service (DoS) attack. It is crucial for developers to apply the provided patch to mitigate the vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/av →
FAQ
This vulnerability can lead to a remote denial of service (DoS) attack, causing the affected application or system to crash and become unresponsive.
The vulnerability was introduced in Android 11 and continues to affect Android 12 and Android 12L.
Yes, successful exploitation of this vulnerability requires user interaction, specifically through the file picker.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, a fix has been provided by the Android Open Source Project (AOSP) in the form of a patch.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
