CVE-2024-43767: Heap Overflow Vulnerability in Skia Package
Summary
CVE-2024-43767: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. Affects platform/external/skia across 4 version ranges.
>= 12:0, < 12:2024-12-01
>= 12L:0, < 12L:2024-12-01
>= 13:0, < 13:2024-12-01
>= 14:0, < 14:2024-12-01
Fixed in 12:2024-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Skia package is a powerful 2D graphics library used extensively in Android for rendering graphics and images. It provides a rich set of features for drawing shapes, text, and images, making it a critical component for applications that require high-quality graphics. However, due to its complexity and wide usage, it is susceptible to vulnerabilities that can compromise the security of applications relying on it.
Vulnerability Detail
In the Skia package, specifically in the function prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there exists a heap overflow vulnerability caused by inadequate input validation. This flaw can be exploited to execute arbitrary code remotely without requiring additional execution privileges. The vulnerability poses a significant risk as it can lead to unauthorized access and control over affected systems, potentially allowing attackers to manipulate or steal sensitive data.
How To Fix
Minimum fixed version
12:2024-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is feasible.
Conclusion
The CVE-2024-43767 vulnerability in the Skia package represents a serious security risk due to its potential for remote code execution. Users are strongly advised to update to the latest patched version to protect their applications from exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security in open-source dependencies.
See every vulnerability recorded for platform/external/skia →
FAQ
CVE-2024-43767 is a vulnerability in the Skia graphics library that can lead to a heap overflow, allowing remote code execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your gradle.lockfile for vulnerabilities.
The risks include unauthorized remote code execution, which can lead to data breaches, system manipulation, and loss of control over affected devices.
No, user interaction is not needed for exploitation, making it particularly dangerous.
While there are no workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/skia.
