In phNxpNciHalwriteunlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"spl": "2022-11-01",
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7162.0,
"function_hash": "95941805404000749890334167924536138770"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-2b426fc1"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491",
"target": {
"file": "halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-a07b1aa5"
}
],
"severity": "High"
}{
"spl": "2022-11-01",
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7162.0,
"function_hash": "95941805404000749890334167924536138770"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-11865510"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/a0c461b91a67f6ee0e86f856bcea2bdac2318491",
"target": {
"file": "halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-25735f29"
}
],
"severity": "High"
}{
"spl": "2022-11-01",
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-486fd4fb"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7169.0,
"function_hash": "70202436915826428778370366148075471606"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-b5c90b9d"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7356.0,
"function_hash": "105225332814135071589178724913404180392"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-b5fed546"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-f404a935"
}
],
"severity": "High"
}{
"spl": "2022-11-01",
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-0587a633"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7356.0,
"function_hash": "105225332814135071589178724913404180392"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-7015178c"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-77485ea1"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7169.0,
"function_hash": "70202436915826428778370366148075471606"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-e88d2d93"
}
],
"severity": "High"
}{
"spl": "2022-11-01",
"fixes": [
"https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae"
],
"types": [
"EoP"
],
"vanir_signatures": [
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-5b3c07de"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7356.0,
"function_hash": "105225332814135071589178724913404180392"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "snxxx/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-6c0dec57"
},
{
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 7169.0,
"function_hash": "70202436915826428778370366148075471606"
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"function": "phNxpNciHal_write_ext",
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-cb6360f1"
},
{
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"219055300527710120337293274866049803551",
"336381885887554992179558876792283641179",
"57139778833048232178722579575282040841",
"191085082137101845790661836300778798488"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/hardware/nxp/nfc/+/9b103dd005ba3b4a33d54518e879010254d897ae",
"target": {
"file": "pn8x/halimpl/hal/phNxpNciHal_ext.cc"
},
"id": "ASB-A-230356196-f63627da"
}
],
"severity": "High"
}