CVE-2021-0561: Medium severity Google Android vulnerability
In appendtoverifyfifointerleaved of streamencoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/flacto a version that resolves this vulnerability.Fixed in 1.3.4 - Upgrade
Upgrade
debian/flacto a version that resolves this vulnerability.Fixed in 1.4.2+ds-2Fixed in 1.5.0+ds-2Fixed in 1.5.0+ds-5 - Upgrade
Upgrade
android/platform/external/flacto a version that resolves this vulnerability.Fixed in 11:2021-06-01
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The issue affects Android 11 and is also associated with Fedora, Debian Linux, and android/platform/external/flac. Exploitation is local, so an attacker needs the ability to execute in the affected local context.
Does exploitation require user interaction or elevated privileges?
No user interaction is required. The reported impact can result in local information disclosure without requiring additional execution privileges.
What is the underlying security impact?
A missing bounds check in append_to_verify_fifo_interleaved_ in stream_encoder.c can cause an out-of-bounds write. The stated consequence is disclosure of information locally; integrity and availability impacts are not listed.