CVE-2023-40082: Rust pvmfw fails to randomize guest KASLR
Summary
CVE-2023-40082: In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto. Affects platform/packages/modules/Virtualization across 2 version ranges.
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/packages/modules/Virtualization in the Android ecosystem. This package is responsible for handling virtualization modules in the Android operating system. It provides functionality for managing virtual machines and their associated resources. The vulnerability affects the Rust pvmfw component within this package.
Vulnerability Detail
The vulnerability in Rust pvmfw arises from a flaw in the modify_for_next_stage function in fdt.rs. This flaw allows an attacker to bypass the randomization of the guest Kernel Address Space Layout Randomization (KASLR) mechanism. By improperly using cryptography, the function fails to properly randomize the guest KASLR, rendering it ineffective. This vulnerability can be exploited remotely without requiring any additional execution privileges. It has the potential to lead to remote escalation of privilege. User interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
In conclusion, the Rust pvmfw component in the platform/packages/modules/Virtualization package in the Android ecosystem is vulnerable to a flaw that allows an attacker to bypass the guest KASLR mechanism. This can lead to remote escalation of privilege. It is recommended to update to the fixed version of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Virtualization →
FAQ
This vulnerability allows an attacker to bypass the guest KASLR mechanism, potentially leading to remote escalation of privilege.
No, user interaction is not needed for exploitation of this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, without requiring access to the code or installation.
The recommended mitigation is to update the platform/packages/modules/Virtualization package to the fixed version, which properly randomizes the guest KASLR.
You can find more information about this vulnerability in the Android Open Source Project's security bulletin: [link to security bulletin].
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Virtualization.
