Google Android memory_group_manager.c mgm_alloc_page out-of-bounds write

CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.1 | $5k-$25k | 0.00 |
Summary
A vulnerability was found in Google Android. It has been declared as critical. Affected by this vulnerability is the function mgm_alloc_page
of the file memory_group_manager.c. The manipulation leads to out-of-bounds write.
This vulnerability is known as CVE-2021-39682. Local access is required to approach this attack. There is no exploit available.
It is recommended to apply a patch to fix this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Details
A vulnerability was found in Google Android (Smartphone Operating System) (the affected version unknown). It has been classified as critical. Affected is the function mgm_alloc_page
of the file memory_group_manager.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability.
The weakness was released 01/15/2022 as A-201677538. The advisory is shared for download at source.android.com. This vulnerability is traded as CVE-2021-39682 since 08/23/2021. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/15/2022). It is expected to see the exploit prices for this product increasing in the near future.
Applying a patch is able to eliminate this problem.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 5.1
VulDB Base Score: 5.3
VulDB Temp Score: 5.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Out-of-bounds writeCWE: CWE-787 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Timeline
08/23/2021 🔍01/15/2022 🔍
01/15/2022 🔍
01/19/2022 🔍
Sources
Vendor: google.comAdvisory: A-201677538
Status: Confirmed
CVE: CVE-2021-39682 (🔍)
GCVE (CVE): GCVE-0-2021-39682
GCVE (VulDB): GCVE-100-190536
scip Labs: https://www.scip.ch/en/?labs.20150917
Entry
Created: 01/15/2022 07:47Updated: 01/19/2022 11:27
Changes: 01/15/2022 07:47 (41), 01/19/2022 11:27 (1)
Complete: 🔍
Cache ID: 216:029:103
No comments yet. Languages: en.
Please log in to comment.