CVE-2021-0471: Information Leak in frameworks/av/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp
Summary
CVE-2021-0471: In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. Affects platform/hardware/interfaces across 4 version ranges.
>= 8.1:0, < 8.1:2021-04-01
>= 9:0, < 9:2021-04-01
>= 10:0, < 10:2021-04-01
>= 11:0, < 11:2021-04-01
Fixed in 8.1:2021-04-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'platform/frameworks/av' in the Android ecosystem. This package is responsible for handling audio and video functionality in the Android operating system. It includes various components such as media codecs, media players, and DRM (Digital Rights Management) plugins. The vulnerability affects the 'CryptoPlugin.cpp' file in the 'clearkey' DRM plugin. This plugin is used for decrypting media content protected by the ClearKey DRM scheme.
Vulnerability Detail
The vulnerability, identified as CVE-2021-0471, resides in the 'decrypt_1_2' function of 'CryptoPlugin.cpp'. It is caused by an integer overflow, leading to a possible out-of-bounds read. An attacker can exploit this vulnerability to gain access to sensitive information stored locally on the device. The exploitation does not require any additional execution privileges or user interaction.
How To Fix
Minimum fixed version
8.1:2021-04-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability CVE-2021-0471 in the 'platform/frameworks/av' package poses a risk of local information disclosure. It is crucial to update the package to the fixed version released on April 1, 2021, to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
This vulnerability can lead to local information disclosure, allowing an attacker to access sensitive data stored on the device.
No, the exploitation of this vulnerability does not require any user interaction.
Yes, this vulnerability affects Android versions 8.1 and above.
Yes, a fix has been released on April 1, 2021, and can be obtained from the provided source.
Yes, the 'platform/hardware/interfaces' package is also affected by this vulnerability and should be updated to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
