CVE-2019-2203: Buffer Overflow
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-137370777
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android 8.0, 8.1, 9, or 10 are listed as affected. Exploitation is local, so an attacker needs a foothold on the device rather than network-only access.
What access does an attacker need to exploit it?
The CVSS vector indicates low privileges are required and no user interaction is needed. Successful exploitation could allow escalation of privilege.
What component should teams investigate when determining exposure?
The vulnerable code is identified as CryptoPlugin::decrypt in CryptoPlugin.cpp. Android issue tracking identifier A-137370777 can be used to correlate the issue with Android security update information.