CVE-2021-0555: Null Pointer Dereference
In RenderStruct of protostreamobjectsource.cc, there is a possible crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/external/protobufto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected product data identifies Android 11 and the Android external protobuf component. The issue is remotely reachable and does not require prior privileges or user interaction.
What does an attacker need to trigger the vulnerability?
An attacker can exploit the missing null check remotely over the network. No additional execution privileges or user interaction are required.
What is the expected impact if exploitation succeeds?
Successful exploitation can cause a crash, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.