CVE-2019-1988: Input Validation

Published Feb 4, 2019

Updated

In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in systemserver with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-118372692.

Affected Software

4 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android

Event History

Feb 4, 2019

CVE Published

via Android·12:00 AM

Feb 28, 2019

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-1988?

CVE-2019-1988 has been classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2019-1988?

To mitigate CVE-2019-1988, users should update their Android devices to the latest security patch provided by Google.

Which Android versions are affected by CVE-2019-1988?

CVE-2019-1988 affects Android versions 8.0, 8.1, and 9.0.

What type of attack does CVE-2019-1988 enable?

CVE-2019-1988 can allow an attacker to execute arbitrary code remotely, given that user interaction is required.

Is user interaction necessary to exploit CVE-2019-1988?

Yes, CVE-2019-1988 requires user interaction for exploitation.