CVE-2023-40110: Heap-buffer-overflow in android::MtpPacket::setContainerCode
Summary
CVE-2023-40110: In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. Affects platform/frameworks/av across 5 version ranges.
>= 11:0, < 11:2023-11-01
>= 12:0, < 12:2023-11-01
>= 12L:0, < 12L:2023-11-01
>= 13:0, < 13:2023-11-01
>= 14:0, < 14:2023-11-01
Fixed in 11:2023-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/av in the Android ecosystem. This package is responsible for handling audio and video functionalities in the Android operating system. It provides APIs and components for media playback, recording, and streaming. The vulnerability affects multiple functions in the MtpPacket.cpp file, specifically related to the handling of MTP (Media Transfer Protocol) packets. MTP is a protocol used for transferring media files between devices. The vulnerability allows for a heap buffer overflow, which can lead to a local escalation of privilege. Exploitation of this vulnerability requires user interaction.
Vulnerability Detail
The vulnerability in the platform/frameworks/av package arises from a heap buffer overflow in the android::MtpPacket::setContainerCode function. This function, along with other related functions in MtpPacket.cpp, fails to properly validate the size of the buffer before writing data to it. As a result, an attacker can craft a malicious MTP packet that triggers an out-of-bounds write, potentially overwriting adjacent memory regions. This can lead to arbitrary code execution or other security consequences. The vulnerability has a high severity rating and affects multiple Android versions (11, 12, 12L, 13, 14). The issue has been fixed in the latest versions of the package.
How To Fix
Minimum fixed version
11:2023-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, users can mitigate the risk by avoiding untrusted MTP connections or media files from unknown sources. Additionally, keeping the device's operating system and all software components up to date can help protect against known vulnerabilities.
Conclusion
In conclusion, the platform/frameworks/av package in the Android ecosystem is vulnerable to a heap buffer overflow in the android::MtpPacket::setContainerCode function. This vulnerability can lead to local privilege escalation, but it requires user interaction for exploitation. It is crucial to update to the latest version of the package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/av →
FAQ
The vulnerability allows for a local escalation of privilege, potentially enabling an attacker to execute arbitrary code or perform unauthorized actions on the affected device.
Yes, user interaction is needed for exploitation. The vulnerability cannot be exploited without user involvement, such as connecting the device to a malicious MTP source or opening a malicious media file.
The vulnerability affects Android versions 11, 12, 12L, 13, and 14.
Yes, the vulnerability has been fixed in the latest versions of the platform/frameworks/av package.
More information about the fix can be found in the commit with the SHA-1 hash 53243faf690a49e00952b3d3956d2fff0b8d4a3c.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
