CVE-2023-21228: Android PMRChangeSparseMemOSMem Out of Bounds Write Vulnerability
Summary
CVE-2023-21228: In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2023-12-05. Fixed in SoCVersion:2023-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vulnerability affects the Android operating system, specifically in the PMRChangeSparseMemOSMem function located in physmem_osmem_linux.c. Android is a widely used mobile operating system that allows developers to create applications for a diverse range of devices. The affected function is responsible for managing memory allocation and access, which is critical for system stability and security. This vulnerability arises from an incorrect bounds check, making it susceptible to exploitation.
Vulnerability Detail
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. The vulnerability is particularly concerning as it allows an attacker to gain elevated privileges without requiring user interaction, potentially compromising the integrity of the system.
How To Fix
Minimum fixed version
SoCVersion:2023-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been documented for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2023-21228 represents a significant security risk within the Android operating system due to an out of bounds write vulnerability. Users are strongly advised to update their systems to the patched version to protect against potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2023-21228 is a vulnerability in the Android operating system that allows for an out of bounds write, potentially leading to local escalation of privilege.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The primary risk is local escalation of privilege, which could allow an attacker to gain unauthorized access to system resources and sensitive data.
No, user interaction is not needed for exploitation, making it particularly dangerous.
To fix this vulnerability, update your device to the patched version available as of 2023-12-05 through the system settings.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
