CVE-2023-21020: UAF problem found in statsd
Summary
CVE-2023-21020: In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. Affects platform/packages/modules/StatsD versions >= 13:0, < 13:2023-03-01. Fixed in 13:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The StatsD package is a module in the Android ecosystem that provides functionality for collecting and aggregating statistics from various sources. It is used to monitor and analyze system performance. However, a vulnerability has been discovered in the package that could lead to local arbitrary code execution.
Vulnerability Detail
The vulnerability exists in the registerSignalHandlers function of the main.cpp file in StatsD. It is caused by a use after free (UAF) issue, where a pointer is accessed after it has been freed. This can result in a local escalation of privilege, potentially allowing an attacker to execute arbitrary code with system execution privileges. Exploitation does not require user interaction.
How To Fix
Minimum fixed version
13:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The StatsD package in the Android ecosystem is vulnerable to a use after free issue, which could lead to local arbitrary code execution. It is recommended to update to the latest version of the package to mitigate this vulnerability.
See every vulnerability recorded for platform/packages/modules/StatsD →
FAQ
The vulnerability could allow an attacker to execute arbitrary code with system execution privileges, potentially leading to a local escalation of privilege.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 13.0 through 13.2023-03-01 of the StatsD package are affected by this vulnerability.
More information about the vulnerability can be found in the following source: https://storage.googleapis.com/android-osv/PUB-A-256591441.json
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/StatsD.
