PT-2021-7385 · Google+7 · Android+7

Published 2021-06-22 · Updated 2024-06-15 · CVE-2021-0561

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Android versions Android-11

Description The issue is related to a missing bounds check in the append to verify fifo interleaved function of stream encoder.c, which could lead to an out of bounds write. This might result in local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation. The vulnerability is associated with the FLAC audio codec.

Recommendations For Android version Android-11, consider applying the fix for the append to verify fifo interleaved function in stream encoder.c to prevent out of bounds writes. As a temporary workaround, restrict access to sensitive data until the issue is resolved.

Fix

NULL Pointer Dereference

Memory Corruption

Weakness Enumeration

CWE-476

CWE-787

Related Identifiers

ALSA-2022:8078

BDU:2022-05919

BDU:2022-06245

CVE-2021-0561

DLA-2951-1

DLA-3094-1

MGASA-2022-0085

OESA-2022-1611

OPENSUSE-SU-2022:0815-1

OPENSUSE-SU-2022:10252-1

OPENSUSE-SU-2022_0815-1

OPENSUSE-SU-2024:11885-1

RHSA-2022:8078

RHSA-2022_8078

RLSA-2022:8078

SUSE-SU-2022:0814-1

SUSE-SU-2022:0815-1

SUSE-SU-2022_0814-1

SUSE-SU-2022_0815-1

USN-5733-1

Affected Products

Almalinux

Android

Astra Linux

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 82

• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0499 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0815-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5174-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06245 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EWXBVMPPSL377I7YM55ZYXVKVMYOKES2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0561 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0085.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/Q4Y7BW35TGNFYBYBSBDSGLUJHHTYEUSG · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10252-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3094-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1611 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6888 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-0561 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0815-1 · Vendor Advisory