CVE-2022-20130: C2FuzzerAacDec: Tag-mismatch in FDK_QmfDomain_InitFilterBank
Summary
CVE-2022-20130: In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/external/aac across 5 version ranges.
>= 10:0, < 10:2022-06-01
>= 11:0, < 11:2022-06-01
>= 12:0, < 12:2022-06-01
>= 12L:0, < 12L:2022-06-01
>= 12L-next:0, < 12L-next:2022-06-01
Fixed in 12L-next:2022-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/external/aac, which is a part of the Android ecosystem. It is responsible for decoding AAC audio files. The package provides functionality for initializing the filter bank used in the decoding process. This vulnerability, identified as CVE-2022-20130, arises due to a tag-mismatch in the FDK_QmfDomain_InitFilterBank function of the C2FuzzerAacDec module. The vulnerability allows for an out of bounds write, leading to a heap buffer overflow. Exploiting this vulnerability could result in remote code execution without requiring any additional execution privileges. User interaction is not necessary for exploitation.
Vulnerability Detail
The vulnerability in the platform/external/aac package is caused by a tag-mismatch in the FDK_QmfDomain_InitFilterBank function of the C2FuzzerAacDec module. This leads to an out of bounds write, causing a heap buffer overflow. An attacker can exploit this vulnerability remotely, without any additional execution privileges. The impact of this vulnerability is critical, as it allows for remote code execution. The vulnerability affects Android versions 10, 11, 12, and 12L.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the platform/external/aac package in Android is vulnerable to a critical remote code execution vulnerability. It is recommended to update the package to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/external/aac →
FAQ
The impact of this vulnerability is critical, as it allows for remote code execution without requiring any additional execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
Android versions 10, 11, 12, and 12L are affected by this vulnerability.
To fix this vulnerability, update the platform/external/aac package to the fixed version available at the provided link.
No workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/aac.
