A vulnerability, which was classified as critical, has been found in Google Android 11/12/12L/13/14 (Smartphone Operating System). This issue affects an unknown part of the file MtpPacket.cpp. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

The weakness was released 02/16/2024. It is possible to read the advisory at android.googlesource.com. The identification of this vulnerability is CVE-2023-40110 since 08/09/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/13/2024). It is expected to see the exploit prices for this product increasing in the near future.

Applying a patch is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 11
• 12
• 12L
• 13
• 14

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion