CVE-2024-33035: Integer Overflow or Wraparound in Display
Summary
CVE-2024-33035: ... Affects platform/hardware/qcom/display versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/hardware/qcom/display, which is a component of the Android ecosystem. This package is responsible for handling display-related functionalities on Qualcomm SoC devices. It includes features such as gralloc (graphics allocator) and buffer management. The vulnerability affects the gralloc/gr_buf_mgr.cpp file within the package.
Vulnerability Detail
The vulnerability is an integer overflow or wraparound issue in the display package. It occurs due to a flaw in the BufferManager::AllocateBuffer function in the gralloc/gr_buf_mgr.cpp file. An attacker can exploit this vulnerability to trigger the overflow or wraparound, potentially leading to arbitrary code execution or a denial of service. The vulnerability has a high severity rating and was introduced in SoCVersion 0, but it has been fixed in SoCVersion 2024-09-05.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The platform/hardware/qcom/display package is vulnerable to an integer overflow or wraparound issue in the BufferManager::AllocateBuffer function. This vulnerability can potentially lead to arbitrary code execution or a denial of service. It is crucial to update the package to the fixed version and apply the necessary patches to mitigate the risk of exploitation.
See every vulnerability recorded for platform/hardware/qcom/display →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service on the affected system.
The vulnerability was introduced in SoCVersion 0 and has been fixed in SoCVersion 2024-09-05.
The fix for this vulnerability can be found in the commit 82c7cf437437e0a0fdadea7cd59e4b1281925283.
No specific workaround has been mentioned for this vulnerability.
The vulnerability has a high severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/qcom/display.
