Google Android up to 8.1 avrc_pars_ct.cc avrc_ctrl_pars_vendor_rsp memory corruption

Summaryinfo

A vulnerability marked as critical has been reported in Google Android 7.0/7.1.1/7.1.2/8.0/8.1. Affected is the function avrc_ctrl_pars_vendor_rsp of the file avrc_pars_ct.cc. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2017-13282. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Google Android 7.0/7.1.1/7.1.2/8.0/8.1 (Smartphone Operating System) and classified as critical. This issue affects the function avrc_ctrl_pars_vendor_rsp of the file avrc_pars_ct.cc. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71603315.

The bug was discovered 04/05/2018. The weakness was presented 04/04/2018 (Website). It is possible to read the advisory at source.android.com. The identification of this vulnerability is CVE-2017-13282 since 08/23/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/21/2020). It is expected to see the exploit prices for this product increasing in the near future.

Applying a patch is able to eliminate this problem.

See VDB-83180, VDB-115633, VDB-115638 and VDB-115639 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 7.0
• 7.1.1
• 7.1.2
• 8.0
• 8.1

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion