In ncisndsetroutingcmd of nci_hmsgs.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"208283816317851276167464264087713045043",
"101512112163818874160315300790181291129",
"227387121055190419413577922687070710536"
]
},
"id": "ASB-A-264879662-1d893a6b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"file": "src/nfc/nci/nci_hmsgs.cc"
}
},
{
"digest": {
"length": 735.0,
"function_hash": "245286270681895241095322239054195438896"
},
"id": "ASB-A-264879662-5268930d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"function": "nci_snd_set_routing_cmd",
"file": "src/nfc/nci/nci_hmsgs.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78"
],
"types": [
"RCE"
],
"spl": "2023-04-01",
"severity": "Critical"
}
{
"vanir_signatures": [
{
"digest": {
"length": 735.0,
"function_hash": "245286270681895241095322239054195438896"
},
"id": "ASB-A-264879662-c7e88808",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"function": "nci_snd_set_routing_cmd",
"file": "src/nfc/nci/nci_hmsgs.cc"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"208283816317851276167464264087713045043",
"101512112163818874160315300790181291129",
"227387121055190419413577922687070710536"
]
},
"id": "ASB-A-264879662-fa5e2d05",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"file": "src/nfc/nci/nci_hmsgs.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78"
],
"types": [
"RCE"
],
"spl": "2023-04-01",
"severity": "Critical"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"208283816317851276167464264087713045043",
"101512112163818874160315300790181291129",
"227387121055190419413577922687070710536"
]
},
"id": "ASB-A-264879662-4d490539",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"file": "src/nfc/nci/nci_hmsgs.cc"
}
},
{
"digest": {
"length": 735.0,
"function_hash": "245286270681895241095322239054195438896"
},
"id": "ASB-A-264879662-61a91699",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"function": "nci_snd_set_routing_cmd",
"file": "src/nfc/nci/nci_hmsgs.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78"
],
"types": [
"RCE"
],
"spl": "2023-04-01",
"severity": "Critical"
}
{
"vanir_signatures": [
{
"digest": {
"length": 735.0,
"function_hash": "245286270681895241095322239054195438896"
},
"id": "ASB-A-264879662-be9d5960",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"function": "nci_snd_set_routing_cmd",
"file": "src/nfc/nci/nci_hmsgs.cc"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"208283816317851276167464264087713045043",
"101512112163818874160315300790181291129",
"227387121055190419413577922687070710536"
]
},
"id": "ASB-A-264879662-d782ad19",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"file": "src/nfc/nci/nci_hmsgs.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78"
],
"types": [
"RCE"
],
"spl": "2023-04-01",
"severity": "Critical"
}
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"208283816317851276167464264087713045043",
"101512112163818874160315300790181291129",
"227387121055190419413577922687070710536"
]
},
"id": "ASB-A-264879662-e074064c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"file": "src/nfc/nci/nci_hmsgs.cc"
}
},
{
"digest": {
"length": 735.0,
"function_hash": "245286270681895241095322239054195438896"
},
"id": "ASB-A-264879662-f9174d19",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78",
"target": {
"function": "nci_snd_set_routing_cmd",
"file": "src/nfc/nci/nci_hmsgs.cc"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/system/nfc/+/1dd4d2e1b481dd83ca2b222993fdb74ae5306c78"
],
"types": [
"RCE"
],
"spl": "2023-04-01",
"severity": "Critical"
}