Google Android up to 9.0 NDEF_MsgValidate Integer integer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Google Android 7.1.1/7.1.2/8.0/8.1/9.0. Affected by this vulnerability is the function NDEF_MsgValidate. The manipulation as part of Integer leads to integer overflow. This vulnerability is uniquely identified as CVE-2019-2179. Local access is required to approach this attack. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Google Android 7.1.1/7.1.2/8.0/8.1/9.0 (Smartphone Operating System). It has been rated as critical. This issue affects the function NDEF_MsgValidate. The manipulation as part of a Integer leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In NDEF_MsgValidate of ndef_utils in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

The weakness was disclosed 09/05/2019. The identification of this vulnerability is CVE-2019-2179 since 12/10/2018. An attack has to be approached locally. The successful exploitation needs a simple authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/13/2023). It is expected to see the exploit prices for this product increasing in the near future.

Applying a patch is able to eliminate this problem.

The entries VDB-141319, VDB-141318, VDB-141316 and VDB-141315 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 7.1.1
• 7.1.2
• 8.0
• 8.1
• 9.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion