Google Android Qualcomm buffer overflow

Summaryinfo

A vulnerability classified as critical was found in Google Android. Impacted is an unknown function of the component Qualcomm Component. Executing a manipulation can lead to buffer overflow. This vulnerability is registered as CVE-2019-2251. The attack needs to be launched locally. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in Google Android (Smartphone Operating System) (version unknown) and classified as critical. This vulnerability affects an unknown function of the component Qualcomm Component. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was published 10/07/2019 as Android Security Bulletin - October 2019 as confirmed bulletin (Website). The advisory is shared for download at source.android.com. This vulnerability was named CVE-2019-2251. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/08/2024). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:

These vulnerabilities affect Qualcomm closed-source components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-143412, VDB-143413, VDB-143414 and VDB-143416. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion