CVE-2023-20935: Out of Bounds Read in libneuralnetworks_common_defaults
Summary
CVE-2023-20935: In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. Affects platform/hardware/interfaces across 4 version ranges.
>= 12:0, < 12:2023-04-01
>= 12L:0, < 12L:2023-04-01
>= 13:0, < 13:2023-04-01
>= 13-next:0, < 13-next:2023-04-01
Fixed in 13-next:2023-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'platform/hardware/interfaces' is a part of the Android ecosystem and is responsible for providing hardware interfaces to the platform. It is used by various components to interact with hardware devices. The package 'platform/packages/modules/NeuralNetworks' is another component of the Android ecosystem that provides support for neural networks. It utilizes the 'platform/hardware/interfaces' package for its functionality.
Vulnerability Detail
The vulnerability (CVE-2023-20935) exists in the 'deserialize' function of multiple files in the 'platform/hardware/interfaces' and 'platform/packages/modules/NeuralNetworks' packages. It is caused by a missing bounds check, which can result in an out of bounds read. This vulnerability can be exploited to disclose local information without requiring additional execution privileges. User interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
13-next:2023-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The 'platform/hardware/interfaces' and 'platform/packages/modules/NeuralNetworks' packages in the Android ecosystem are affected by a vulnerability that allows for out of bounds read. This can lead to local information disclosure, but does not grant additional execution privileges. It is recommended to update the affected packages to their fixed versions released on or after April 1, 2023. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
This vulnerability can lead to local information disclosure, potentially exposing sensitive data. However, it does not grant additional execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 11, 12, 12L, and 13 of the Android ecosystem are affected by this vulnerability.
There are no known instances of this vulnerability being exploited at the time of this report.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It requires no signup and uses the gradle.lockfile to monitor and alert in real-time for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
