CVE-2022-20412: Heap-buffer-overflow in libfdt_fuzzer
Summary
CVE-2022-20412: In fdt_next_tag of fdt.c, there is a possible out of bounds read due to an incorrect bounds check. Affects platform/external/dtc across 5 version ranges.
>= 10:0, < 10:2022-10-01
>= 11:0, < 11:2022-10-01
>= 12:0, < 12:2022-10-01
>= 12L:0, < 12L:2022-10-01
>= 13:0, < 13:2022-10-01
Fixed in 10:2022-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'platform/external/dtc' in the Android ecosystem. This package is responsible for handling device tree compiler (dtc) functionality. It is used to compile and decompile device tree source files, which describe the hardware layout of a system. The package is widely used in Android versions 10 and above.
Vulnerability Detail
The vulnerability, identified as CVE-2022-20412, exists in the 'libfdt_fuzzer' component of the 'platform/external/dtc' package. Specifically, the issue arises in the 'fdt_next_tag' function within 'fdt.c'. The vulnerability stems from an incorrect bounds check, leading to a possible out-of-bounds read. Exploitation of this vulnerability could result in local escalation of privilege, requiring system execution privileges. Notably, user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
10:2022-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the 'platform/external/dtc' package in the Android ecosystem is vulnerable to a heap-buffer-overflow issue in the 'libfdt_fuzzer' component. This vulnerability, identified as CVE-2022-20412, could allow local privilege escalation without requiring user interaction. To mitigate the risk, it is advised to update the package to a fixed version released on or after October 1, 2022. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/external/dtc →
FAQ
The vulnerability could potentially allow an attacker to escalate their privileges locally, gaining system execution privileges. This could lead to unauthorized access and control over the affected system.
No, user interaction is not needed for the vulnerability to be exploited.
The vulnerability affects Android versions 10 and above, including versions 11, 12, 12L, and 13.
The severity of this vulnerability is classified as 'High'.
You can find more information about this vulnerability in the Android Open Source Project (AOSP) Security Bulletin ASB-A-230794395.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dtc.
