In handlePollingLoopData of hal_fwlog.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/hardware/st/nfc/+/b7056d70f2cdd1596a95048e4ee80b6d91bcb3e0"
],
"spl": "2025-02-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/st/nfc/+/b7056d70f2cdd1596a95048e4ee80b6d91bcb3e0",
"target": {
"function": "handlePollingLoopData",
"file": "st21nfc/hal/hal_fwlog.cc"
},
"deprecated": false,
"digest": {
"function_hash": "165987197722151145039007725392439655065",
"length": 2175.0
},
"signature_type": "Function",
"id": "ASB-A-356630194-1749863c"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/st/nfc/+/b7056d70f2cdd1596a95048e4ee80b6d91bcb3e0",
"target": {
"file": "st21nfc/hal/hal_fwlog.cc"
},
"deprecated": false,
"digest": {
"line_hashes": [
"184901186016634046180835950952564806967",
"186216076513178507879449714996662973261",
"126698021011107253298906417944068204446",
"259331588106946646897741373686426685891"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-356630194-f240b6c5"
}
],
"types": [
"EoP"
]
}
{
"severity": "High",
"fixes": [
"https://android.googlesource.com/platform/hardware/st/nfc/+/2c6225e82a0d3d721fb84a3828a9916bc9b7aa89"
],
"spl": "2025-02-01",
"vanir_signatures": [
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/st/nfc/+/2c6225e82a0d3d721fb84a3828a9916bc9b7aa89",
"target": {
"file": "st21nfc/hal/hal_fwlog.cc"
},
"deprecated": false,
"digest": {
"line_hashes": [
"184901186016634046180835950952564806967",
"186216076513178507879449714996662973261",
"126698021011107253298906417944068204446",
"259331588106946646897741373686426685891"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "ASB-A-356630194-2a5c8d54"
},
{
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/hardware/st/nfc/+/2c6225e82a0d3d721fb84a3828a9916bc9b7aa89",
"target": {
"function": "handlePollingLoopData",
"file": "st21nfc/hal/hal_fwlog.cc"
},
"deprecated": false,
"digest": {
"function_hash": "165987197722151145039007725392439655065",
"length": 2175.0
},
"signature_type": "Function",
"id": "ASB-A-356630194-771909bc"
}
],
"types": [
"EoP"
]
}