Google Android up to 8.1 ih264d_utils.c ih264d_fmt_conv_420sp_to_420p out-of-bounds write

Summaryinfo

A vulnerability categorized as critical has been discovered in Google Android up to 8.1. Affected by this issue is the function ih264d_fmt_conv_420sp_to_420p of the file ih264d_utils.c. Executing a manipulation can lead to out-of-bounds write. This vulnerability is tracked as CVE-2017-13250. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical was found in Google Android up to 8.1 (Smartphone Operating System). This vulnerability affects the function ih264d_fmt_conv_420sp_to_420p of the file ih264d_utils.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c, there is an out of bound write due to a missing out of bounds check because of a multiplication error. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71375536.

The bug was discovered 03/05/2018. The weakness was disclosed 04/04/2018 by Amir with Zimperium zLabs (Website). The advisory is shared for download at source.android.com. This vulnerability was named CVE-2017-13250 since 08/23/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/21/2020). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 30 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103255†). The entries VDB-114373, VDB-114375, VDB-114638 and VDB-114639 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 6.0
• 6.0.1
• 7.0
• 7.1.1
• 7.1.2
• 8.0
• 8.1

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion