CVE-2022-20524: android.hardware.vibrator-service.example_fuzzer: Heap-use-after-free in Vibrator.cpp
Summary
CVE-2022-20524: In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. Affects platform/hardware/interfaces versions >= 13:0, < 13:2022-12-01. Fixed in 13:2022-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The android.hardware.vibrator-service.example_fuzzer package is a component of the Android ecosystem that provides functionality related to the vibrator service. This service allows applications to control the device's vibrator hardware. The Vibrator.cpp file is a crucial part of the package, responsible for composing and performing vibration patterns. However, a vulnerability has been discovered in this file that could lead to arbitrary code execution.
Vulnerability Detail
The vulnerability in Vibrator.cpp is a heap-use-after-free issue. This means that after a memory block has been freed, it is still being accessed, potentially leading to memory corruption and arbitrary code execution. Exploiting this vulnerability could result in local escalation of privilege, allowing an attacker to gain elevated privileges without requiring additional execution privileges. It is important to note that user interaction is not necessary for exploitation.
How To Fix
Minimum fixed version
13:2022-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The android.hardware.vibrator-service.example_fuzzer package contains a vulnerability in the Vibrator.cpp file that could lead to arbitrary code execution. It is crucial to update to version 13.2022-12-01 or later to mitigate this issue.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
This vulnerability could allow an attacker to execute arbitrary code and potentially escalate their privileges on the affected device.
No, user interaction is not needed for exploitation of this vulnerability.
Versions 13.0 through 13.2022-12-01 of the android.hardware.vibrator-service.example_fuzzer package are affected.
The recommended mitigation is to update the android.hardware.vibrator-service.example_fuzzer package to version 13.2022-12-01 or later.
More information about this vulnerability can be found in the official Android Open Source Project (AOSP) repository: https://android.googlesource.com/platform/hardware/interfaces/+/608655b45078e310fdc233b7dab325ac5abb9aae
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
