PT-2021-13167 · Google · Android

Published 2021-08-01 · Updated 2021-08-24 · CVE-2021-0519

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Android versions 8.1 through 11

Description: In the BITSTREAM FLUSH function of ih264e bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. The issue is related to the Media Framework platform and could lead to elevation of privileges on Android 8.1 and 9 devices or information disclosure on Android 10 and 11 devices.

Recommendations: For Android versions 8.1 through 11, update the operating system to the latest version that includes the security patch for this issue. As a temporary workaround, consider restricting access to the ih264e bitstream.h module to minimize the risk of exploitation. Avoid using the BITSTREAM FLUSH function until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ASB-A-176533109

CVE-2021-0519

Affected Products

Android

References · 7

• https://source.android.com/security/bulletin/2021-08-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0519 · Security Note
• https://osv.dev/vulnerability/ASB-A-176533109 · Vendor Advisory
• https://t.me/cvenotify/19992 · Telegram Post
• https://android.googlesource.com/platform/external/libavc/+/10910bf9106eff724390255faa48f9f61dcfc744 · Note
• https://t.me/true_secator/1971 · Telegram Post