CVE-2024-33042: Buffer Copy Without Checking Size of Input in FMHost
Summary
CVE-2024-33042: ... Affects platform/vendor/qcom-opensource/fm-commonsys versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The FMHost package is part of the fm-commonsys platform in the Android ecosystem. It is responsible for managing FM radio functionality on Qualcomm Snapdragon SoCs. FMHost provides APIs and drivers for controlling FM radio hardware and handling radio-related events. This vulnerability affects FMHost and can lead to a classic buffer overflow.
Vulnerability Detail
The vulnerability in FMHost arises from a buffer copy operation that does not properly check the size of the input. This can allow an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a system crash. The vulnerability was introduced in SoCVersion 0 and has been fixed in SoCVersion 2024-09-05.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The FMHost package in the fm-commonsys platform is vulnerable to a buffer overflow due to a lack of input size checking. This vulnerability can have serious consequences, including arbitrary code execution or system crashes. It is crucial to update the fm-commonsys package to the fixed version to mitigate the risk.
See every vulnerability recorded for platform/vendor/qcom-opensource/fm-commonsys →
FAQ
FMHost is a package in the fm-commonsys platform that manages FM radio functionality on Qualcomm Snapdragon SoCs.
A buffer overflow is a vulnerability where a program writes data beyond the boundaries of a buffer, potentially overwriting adjacent memory locations.
The vulnerability can lead to arbitrary code execution or system crashes, depending on how the attacker exploits it.
The vulnerability was introduced in SoCVersion 0 and fixed in SoCVersion 2024-09-05.
To fix this vulnerability, update the fm-commonsys package to the fixed version. Refer to the provided commit link for the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom-opensource/fm-commonsys.
