CVE-2017-13291: Null Pointer Dereference
In avrcctrlparsvendorrsp of avrcparsct.cc, there is a possible NULL pointer dereference due to missing bounds checks. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71603553.
Affected Software
Event History
Frequently Asked Questions
Which Android releases are listed as affected?
The affected versions listed are Android 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network access with low attack complexity, no privileges required, and no user interaction required.
What is the practical impact of successful exploitation?
Successful exploitation can cause a remote denial of service through a NULL pointer dereference. The provided CVSS vector indicates no confidentiality or integrity impact, with high availability impact.
How can I track the vendor remediation for this issue?
The issue is tracked by Android ID A-71603553. The provided references include the Android April 2018 security bulletin and the associated source change.