Open Source Vulnerability in platform/frameworks/base: incidentd_service_fuzzer: Abrt in android::os::incidentd::IncidentService::onTransact
Summary
CVE-2023-40091: In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. Affects platform/frameworks/base across 6 version ranges.
>= 11:0, < 11:2023-12-01
>= 12:0, < 12:2023-12-01
>= 12L:0, < 12L:2023-12-01
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/base package is a fundamental component of the Android operating system. It provides core functionalities and services for the Android framework. One of these services is the IncidentService, which handles the collection and reporting of system incidents. Incidents are diagnostic data collected by the system when certain events or errors occur. The IncidentService is responsible for processing and transmitting these incidents to the appropriate channels for analysis and debugging.
Vulnerability Detail
The vulnerability, identified as incidentd_service_fuzzer, exists in the onTransact function of the IncidentService.cpp file. It is caused by a memory corruption issue that can lead to an out-of-bounds write. An attacker could exploit this vulnerability to escalate their privileges locally without requiring any additional execution privileges. Notably, user interaction is not necessary for the successful exploitation of this vulnerability.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is essential to apply the provided fix by updating the platform/frameworks/base package to a version that includes the necessary patches.
Conclusion
The incidentd_service_fuzzer vulnerability in the platform/frameworks/base package poses a high risk as it allows for local privilege escalation without user interaction. It is crucial to update the package to a version that includes the necessary fixes to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability could allow an attacker to escalate their privileges locally, potentially gaining unauthorized access to sensitive system resources and data.
No, user interaction is not necessary for the successful exploitation of this vulnerability.
Versions 11, 12, 12L, 13, and 14 of the Android operating system are affected by this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, allowing you to assess the impact on your software without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
