CVE-2022-20147: Out of Bounds Read in nfa_dm_check_set_config Function in nfc
Summary
CVE-2022-20147: In nfa_dm_check_set_config of nfa_dm_main.cc, there is a possible out of bounds write due to a missing bounds check. Affects platform/system/nfc across 5 version ranges.
>= 10:0, < 10:2022-06-01
>= 11:0, < 11:2022-06-01
>= 12:0, < 12:2022-06-01
>= 12L:0, < 12L:2022-06-01
>= 12L-next:0, < 12L-next:2022-06-01
Fixed in 12L-next:2022-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package 'platform/system/nfc' is part of the Android ecosystem and is responsible for handling Near Field Communication (NFC) functionality. NFC enables communication between devices in close proximity, allowing for contactless transactions, data transfer, and other interactions. This package provides the necessary components and APIs for NFC operations on Android devices.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20147, exists in the 'nfa_dm_check_set_config' function within the 'nfa_dm_main.cc' file of the 'platform/system/nfc' package. It is caused by a missing bounds check, leading to an out of bounds write issue. An attacker could exploit this vulnerability to escalate their privileges locally, without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
12L-next:2022-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability CVE-2022-20147 in the 'platform/system/nfc' package exposes a potential local privilege escalation issue. To mitigate this vulnerability, it is crucial to update the package to a version that includes the provided fix. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for platform/system/nfc →
FAQ
The vulnerability allows for local privilege escalation, potentially enabling an attacker to gain elevated privileges on the affected device. However, it does not grant remote access or execution capabilities.
No, user interaction is not necessary for an attacker to exploit this vulnerability.
This vulnerability affects Android versions 10, 11, 12, and 12L. However, devices running versions released after June 1, 2022, should have the necessary fix applied.
No specific workarounds have been provided for this vulnerability. It is recommended to apply the official fix as soon as possible.
You can find more information about this vulnerability, including technical details and the fix, in the official Android Open Source Project (AOSP) security bulletin: https://storage.googleapis.com/android-osv/ASB-A-221216105.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/nfc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
