Heap-use-after-free vulnerability in platform/system/netd
Summary
CVE-2023-40084: In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free. Affects platform/system/netd across 6 version ranges.
>= 11:0, < 11:2023-12-01
>= 12:0, < 12:2023-12-01
>= 12L:0, < 12L:2023-12-01
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package platform/system/netd is a component of the Android ecosystem that handles network-related functionalities. It is responsible for managing network interfaces, routing tables, and DNS resolution. The package is an integral part of the Android operating system and is present in versions 11 and above. However, it is vulnerable to a heap-use-after-free vulnerability in the MDnsSdListener::Monitor::run function.
Vulnerability Detail
The vulnerability arises due to a memory corruption issue caused by a use-after-free bug. This bug can be exploited locally to escalate privileges without requiring any additional execution privileges. The vulnerability exists in the MDnsSdListener.cpp file and does not require user interaction for exploitation. If successfully exploited, an attacker could gain elevated privileges on the affected Android device.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The platform/system/netd package in the Android ecosystem is vulnerable to a heap-use-after-free vulnerability. This vulnerability can be exploited locally to escalate privileges without requiring additional execution privileges. It is recommended to update the package to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/system/netd →
FAQ
platform/system/netd is a package in the Android ecosystem that handles network-related functionalities, such as managing network interfaces, routing tables, and DNS resolution.
A use-after-free vulnerability occurs when a program continues to use a memory address after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or escalate privileges.
This vulnerability can be exploited locally on an Android device by leveraging the use-after-free bug in the MDnsSdListener::Monitor::run function. Successful exploitation can result in privilege escalation.
No, user interaction is not required for the exploitation of this vulnerability.
Versions 11, 12, 12L, 13, and 14 of the Android operating system are affected by this vulnerability.
