CVE-2022-20473: Stack-buffer-overflow in ulocimp_toLanguageTag_71 in platform/frameworks/minikin
Summary
CVE-2022-20473: In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. Affects platform/frameworks/minikin across 5 version ranges.
>= 10:0, < 10:2022-12-01
>= 11:0, < 11:2022-12-01
>= 12:0, < 12:2022-12-01
>= 12L:0, < 12L:2022-12-01
>= 13:0, < 13:2022-12-01
Fixed in 10:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/minikin package is a part of the Android ecosystem and is responsible for handling font rendering and text layout. It provides support for various font formats and text shaping operations. This package is used by the Android operating system to render text in applications and system components.
Vulnerability Detail
In the toLanguageTag function of LocaleListCache.cpp, there is a vulnerability that allows for a stack-buffer-overflow. This occurs due to an incorrect bounds check, which can result in an out-of-bounds read. An attacker could exploit this vulnerability to execute remote code without requiring additional privileges. It is important to note that user interaction is not necessary for the successful exploitation of this vulnerability.
How To Fix
Minimum fixed version
10:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is recommended to apply the fix provided by updating the affected package.
Conclusion
The CVE-2022-20473 vulnerability in the platform/frameworks/minikin package poses a critical risk to the security of the Android operating system. It allows for a stack-buffer-overflow, potentially leading to remote code execution without requiring additional privileges. To mitigate this vulnerability, it is crucial to update the affected package to a fixed version released on or after December 1, 2022. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/minikin →
FAQ
This vulnerability could potentially allow an attacker to execute remote code on the affected system without requiring any additional privileges. It is a critical vulnerability that could be exploited to compromise the security and integrity of the Android operating system.
No, user interaction is not needed for the successful exploitation of this vulnerability. An attacker can exploit this vulnerability remotely without any user interaction.
This vulnerability affects Android versions 10, 11, 12, 12L, and 13. It is recommended to update to a fixed version released on or after December 1, 2022.
The only known mitigation for this vulnerability is to update the affected package to a version that includes the necessary security patches. It is important to keep the software up to date to protect against potential exploits.
You can find more information about this vulnerability in the Android Open Source Project (AOSP) security bulletin: [link to bulletin].
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/minikin.
