Lucene search

GoogleOSV:ASB-A-275418191

HistoryJun 01, 2023 - 12:00 a.m.

NuMediaExtractor::readSampleData() SEGV failures

2023-06-0100:00:00

Google

osv.dev

remote code execution

uninitialized data

user interaction

software

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.7%

JSON

In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CPENameOperatorVersion
platform/frameworks/aveq12
platform/frameworks/aveq11
platform/frameworks/aveq12L
platform/frameworks/aveq13

Name	Operator	Version
platform/frameworks/av	eq	12
platform/frameworks/av	eq	11
platform/frameworks/av	eq	12L
platform/frameworks/av	eq	13

References

android.googlesource.com/platform/frameworks/av/+/ff06107de18166f1d97baddabfe23a608ef35ceb

source.android.com/security/bulletin/2023-06-01

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.7%

JSON

Related for OSV:ASB-A-275418191