CVE-2022-20472: Tag-mismatch in _getVariant in platform/frameworks/minikin
Summary
CVE-2022-20472: In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. Affects platform/frameworks/minikin across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/minikin package is a part of the Android ecosystem and is responsible for font rendering on Android devices. It provides functionality for handling locale-specific font variants. This package is used by various Android versions, starting from Android 10. However, a vulnerability has been discovered in the _getVariant function of the locale_fuzzer module, which can lead to remote code execution without requiring additional execution privileges.
Vulnerability Detail
The vulnerability exists in the toLanguageTag function of the LocaleListCache.cpp file. Due to an incorrect bounds check, there is a possibility of an out-of-bounds read. An attacker can exploit this vulnerability to execute arbitrary code remotely. The exploitation does not require any user interaction. This vulnerability has been assigned CVE-2022-20472.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the platform/frameworks/minikin package in Android is vulnerable to remote code execution due to a tag-mismatch issue in the _getVariant function. It is crucial to update the package to the fixed version released after December 1, 2022, to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/minikin →
FAQ
This vulnerability can lead to remote code execution on Android devices. An attacker can exploit this vulnerability without requiring any additional execution privileges.
No, user interaction is not needed for the exploitation of this vulnerability.
This vulnerability affects Android versions 10, 11, 12, 12L, and 13.
Yes, the fix for this vulnerability is available in versions of platform/frameworks/minikin released after December 1, 2022.
You can find more information about this vulnerability in the Android Open Source Vulnerability database.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/minikin.
