A vulnerability was found in Google Android (Smartphone Operating System) (affected version unknown). It has been declared as critical. This vulnerability affects an unknown functionality of the component FingerTipS Touchscreen Driver. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

The weakness was disclosed 09/06/2019. This vulnerability was named CVE-2019-9248 since 02/28/2019. The attack needs to be approached locally. The successful exploitation needs a single authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/13/2023). It is expected to see the exploit prices for this product increasing in the near future.

Applying a patch is able to eliminate this problem.

The entries 141356, 141355, 141354 and 141353 are pretty similar.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion