CVE-2024-33054: Buffer Overflow in ComputerVision Package
Summary
CVE-2024-33054: ... Affects platform/vendor/opensource/eva-kernel versions >= SoCVersion:0, < SoCVersion:2024-09-05. Fixed in SoCVersion:2024-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ComputerVision package is a component of the Android ecosystem, specifically the platform/vendor/opensource/eva-kernel package. It is responsible for handling computer vision tasks and features in Android devices. The package includes various modules and functions related to computer vision processing. Unfortunately, a buffer overflow vulnerability has been discovered in the package, which could potentially allow an attacker to execute arbitrary code or crash the system.
Vulnerability Detail
The vulnerability, identified as CVE-2024-33054, is a classic buffer overflow issue. It occurs in the cvp_vm_msgq.c file of the ComputerVision package. The specific function affected is cvp_msgq_receiver. The vulnerability arises due to a lack of proper input size validation when copying data into a buffer. This allows an attacker to provide malicious input that exceeds the buffer's capacity, leading to a buffer overflow. If successfully exploited, this vulnerability can result in arbitrary code execution or system crashes, potentially compromising the security and stability of the Android device.
How To Fix
Minimum fixed version
SoCVersion:2024-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is crucial to apply the patch or update the package to the fixed version as soon as possible.
Conclusion
The ComputerVision package in the Android ecosystem is vulnerable to a buffer overflow issue, identified as CVE-2024-33054. This vulnerability can potentially allow an attacker to execute arbitrary code or crash the system. It is crucial to update the package to the fixed version or apply the provided patch to mitigate the risk.
See every vulnerability recorded for platform/vendor/opensource/eva-kernel →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or crash the system, compromising the security and stability of the Android device.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the gradle.lockfile.
No, there is no known workaround for this vulnerability. It is essential to update the package to the fixed version to mitigate the risk.
The patch for this vulnerability can be found at the following link: https://git.codelinaro.org/clo/la/platform/vendor/opensource/eva-kernel/-/commit/76af94175140cc945a651f99481f8a9b2c0b789d
This vulnerability is classified as high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/opensource/eva-kernel.
