CVE-2024-43091: Skia Package Out of Bounds Write Vulnerability
Summary
CVE-2024-43091: In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. Affects platform/external/skia across 6 version ranges.
>= 12:0, < 12:2024-11-01
>= 12L:0, < 12L:2024-11-01
>= 13:0, < 13:2024-11-01
>= 14:0, < 14:2024-11-01
>= 15:0, < 15:2024-11-01
>= 15-next:0, < 15-next:2024-11-01
Fixed in 15-next:2024-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Skia package is an open-source graphics library used extensively in Android for rendering 2D graphics. It provides a rich set of features for drawing shapes, text, and images, making it a crucial component for applications that require graphical rendering. However, a recent vulnerability has been identified that could potentially compromise the security of applications utilizing this library.
Vulnerability Detail
The vulnerability exists in the filterMask function of SkEmbossMaskFilter.cpp, where an integer overflow can lead to an out-of-bounds write. This flaw allows for remote code execution without requiring additional execution privileges or user interaction. The exploitation of this vulnerability could enable an attacker to execute arbitrary code on the affected system, posing significant security risks.
How To Fix
Minimum fixed version
15-next:2024-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2024-43091 vulnerability in the Skia package presents a serious security risk due to the potential for remote code execution. Users are strongly advised to update to the patched version to protect their applications from exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/external/skia →
FAQ
CVE-2024-43091 is a vulnerability in the Skia graphics library that allows for remote code execution due to an out-of-bounds write caused by an integer overflow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. This tool analyzes your gradle.lockfile to identify vulnerabilities without requiring any installation.
The primary risk is remote code execution, which could allow attackers to execute arbitrary code on the affected system, potentially leading to data breaches or system compromise.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/skia.
