CVE-2017-13253: Critical severity Google Android vulnerability
Published Mar 5, 2018
·Updated
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-71389378.
Affected Software
3 affected components
Google Android=8.0
Google Android=8.1
Google Android
Event History
Mar 5, 2018
CVE Published
via Android·12:00 AM
Apr 4, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Android releases are affected?
The affected versions listed are Android 8.0 and 8.1.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access and no privileges are required, but user interaction is required. Successful exploitation could result in local privilege escalation.
3
What is the potential impact of successful exploitation?
The out-of-bounds write in CryptoPlugin::decrypt could allow an attacker to gain elevated local privileges. The reported impact includes high confidentiality, integrity, and availability impact.