CVE-2017-13179: Use After Free

Published Jan 2, 2018

Updated

In the ihevcdallocatestaticbufs and ihevcdcreate functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both pscodecobj and pscreateop->sivdcreateopt.pvhandle point to the same memory and pscodecobj could be freed without clearing pscreateop->sivdcreateopt.pvhandle. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969193.

Affected Software

7 affected components

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2018-01-01

Event History

Jan 2, 2018

CVE Published

via Android·12:00 AM

Jan 12, 2018

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-13179?

CVE-2017-13179 has a CVSS score of high severity due to potential out-of-bounds write vulnerabilities.

How do I fix CVE-2017-13179?

To fix CVE-2017-13179, update to the latest version of the affected Android software as specified by Google.

What types of systems are affected by CVE-2017-13179?

CVE-2017-13179 affects multiple versions of Android, including 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.

What causes CVE-2017-13179?

CVE-2017-13179 is caused by a use after free vulnerability in the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC.

Is CVE-2017-13179 exploitable remotely?

CVE-2017-13179 may be exploitable remotely, making it critical to address the vulnerability promptly.