CVE-2024-33038: Untrusted Pointer Dereference in ComputerVision
Summary
CVE-2024-33038: ... Affects platform/vendor/opensource/eva-kernel versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is 'platform/vendor/opensource/eva-kernel' in the Android ecosystem. This package is responsible for handling computer vision functionalities. It is used in various Android devices. The vulnerability affects the package's 'msm/eva/msm_cvp_dsp.c' file and specifically the '__dsp_cvp_power_req' function.
Vulnerability Detail
The vulnerability is an untrusted pointer dereference issue in the ComputerVision package. It allows an attacker to manipulate a pointer to access or modify memory locations that they should not have access to. This can lead to various security issues, including remote code execution, information disclosure, or system crashes. The vulnerability was introduced in SoCVersion 0 and has been fixed in SoCVersion 2024-09-05.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
The 'platform/vendor/opensource/eva-kernel' package in the Android ecosystem is vulnerable to an untrusted pointer dereference issue in the ComputerVision functionality. This vulnerability can lead to remote code execution, information disclosure, or system crashes. It has been fixed in the latest version of the package, which can be obtained by updating to the commit '849b1c0f92c365c22a83492bb91590075be18c2b'. No workaround has been mentioned for this vulnerability.
See every vulnerability recorded for platform/vendor/opensource/eva-kernel →
FAQ
The vulnerability can lead to remote code execution, information disclosure, or system crashes.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your gradle.lockfile and provides real-time alerts for open-source vulnerabilities.
Yes, a fix is available in the latest version of the 'platform/vendor/opensource/eva-kernel' package. It can be obtained by updating to the commit '849b1c0f92c365c22a83492bb91590075be18c2b'.
Yes, this vulnerability can be exploited remotely, potentially allowing an attacker to execute arbitrary code on the affected system.
The vulnerability was introduced in SoCVersion 0 and has been fixed in SoCVersion 2024-09-05.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/opensource/eva-kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
