Double-free Vulnerability in com.android.vending
Summary
CVE-2023-40103: In multiple locations, there is a possible way to corrupt memory due to a double free. Affects platform/frameworks/base versions < 14-next:2023-12-01. Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The com.android.vending package is a part of the Android Open Source Project (AOSP) and is responsible for managing the Google Play Store on Android devices. It provides functionality for downloading, updating, and managing applications on the device. The package is critical for the proper functioning of the Google Play Store and is present on all Android devices. However, a vulnerability has been discovered in this package that could allow for local escalation of privilege.
Vulnerability Detail
The vulnerability in com.android.vending is due to a double-free issue present in multiple locations within the code. A double-free occurs when a program attempts to free a memory block that has already been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or gain elevated privileges on the affected device. The vulnerability does not require any user interaction for exploitation, making it particularly dangerous. It has been assigned a severity rating of High.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the official fix as mentioned in the 'how_to_fix' section.
Conclusion
The com.android.vending package in the Android Open Source Project (AOSP) is vulnerable to a double-free issue that could lead to local escalation of privilege. It is recommended to update the package to the latest version using the provided fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
com.android.vending is a package in the Android Open Source Project (AOSP) that manages the Google Play Store on Android devices. It is responsible for downloading, updating, and managing applications on the device.
A double-free vulnerability occurs when a program attempts to free a memory block that has already been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or gain elevated privileges.
This vulnerability could allow for local escalation of privilege on the affected device. An attacker could potentially execute arbitrary code or gain elevated privileges without requiring any additional execution privileges.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability has been assigned a severity rating of High.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
