CVE-2021-0587: android.hardware.audio-service - Thread UAFs
Summary
CVE-2021-0587: In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. Affects platform/hardware/interfaces across 4 version ranges.
>= 8.1:0, < 8.1:2021-07-01
>= 9:0, < 9:2021-07-01
>= 10:0, < 10:2021-07-01
>= 11:0, < 11:2021-07-01
Fixed in 8.1:2021-07-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The android.hardware.audio-service package is a component of the Android operating system that provides audio-related functionality. It includes features such as audio input and output management, audio routing, and audio effects. This package is an integral part of the Android ecosystem and is used by various applications and system components. However, it is susceptible to a vulnerability that can lead to local privilege escalation.
Vulnerability Detail
The vulnerability (CVE-2021-0587) exists in the StreamOut::prepareForWriting function of StreamOut.cpp in the android.hardware.audio-service package. It is caused by a use-after-free issue, where a thread continues to access a memory location after it has been freed. This can result in an out-of-bounds write, potentially allowing an attacker to escalate their privileges on the local system. Exploitation of this vulnerability does not require user interaction.
How To Fix
Minimum fixed version
8.1:2021-07-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general security practice, it is advisable to follow good security hygiene, such as keeping your Android device up to date with the latest security patches, avoiding installation of unknown or untrusted applications, and being cautious while granting permissions to apps.
Conclusion
The android.hardware.audio-service package is vulnerable to a use-after-free issue that can lead to local privilege escalation. It is crucial to update the package to the fixed version released on July 1, 2021, to mitigate the risk. Regularly updating your Android device with security patches and following good security practices will help protect against known vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/hardware/interfaces →
FAQ
This vulnerability can potentially allow an attacker to escalate their privileges on the local system. However, exploitation of this vulnerability requires local access to the targeted device.
No, user interaction is not needed for the successful exploitation of this vulnerability.
The vulnerability affects Android versions 8.1 and above.
Yes, a fix for this vulnerability was released on July 1, 2021.
To protect your device, ensure that you regularly update your Android device with the latest security patches and follow good security practices.
Related vulnerabilities
Recent vulnerabilities recorded for platform/hardware/interfaces.
