CVE-2022-20454: The bootloader libfdt bug in platform/external/dtc
Summary
CVE-2022-20454: In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. Affects platform/external/dtc across 5 version ranges.
>= 10:0, < 10:2022-11-01
>= 11:0, < 11:2022-11-01
>= 12:0, < 12:2022-11-01
>= 12L:0, < 12L:2022-11-01
>= 13:0, < 13:2022-11-01
Fixed in 10:2022-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The platform/external/dtc package is a component of the Android ecosystem. It is responsible for handling device tree files used in bootloaders. Device tree files provide a structured description of the hardware components of a system. The package includes various tools and libraries for manipulating and validating device tree files. However, a vulnerability has been discovered in the bootloader libfdt library, which could allow an attacker to escalate privileges on the system.
Vulnerability Detail
The vulnerability (CVE-2022-20454) exists in the fdt_next_tag function of the fdt.c file in the platform/external/dtc package. It is caused by an integer overflow, leading to an out-of-bounds write. An attacker with local access to the system could exploit this vulnerability to escalate their privileges. The exploitation does not require any user interaction. The impact of this vulnerability is the potential for an attacker to gain system execution privileges.
How To Fix
Minimum fixed version
10:2022-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the platform/external/dtc package.
Conclusion
The bootloader libfdt bug in the platform/external/dtc package (CVE-2022-20454) poses a risk of privilege escalation for systems using affected versions. To mitigate this vulnerability, it is crucial to update the package to a version released after November 1, 2022. Regularly updating the package will ensure the latest security patches are applied. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for platform/external/dtc →
FAQ
The platform/external/dtc package is a component of the Android ecosystem responsible for handling device tree files used in bootloaders.
The vulnerability allows an attacker to escalate their privileges on the system, potentially gaining system execution privileges.
No, user interaction is not required for exploitation of this vulnerability.
To fix this vulnerability, update the platform/external/dtc package to a version released after November 1, 2022, which includes the necessary fix.
No specific workarounds are mentioned for this vulnerability. It is recommended to apply the fix by updating the platform/external/dtc package.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dtc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
