In setRange of ABuffer.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"99336650113145862943455766920828787924",
"268483394458467215126629887983034763332",
"133483796300706529004282082419582802410",
"236296815166282452170750574247494226851"
]
},
"id": "PUB-A-179046129-9d034aee",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/av/+/e69aac87d04a11d08df07a26dfd809b1478c27f6",
"target": {
"file": "media/libstagefright/foundation/ABuffer.cpp"
}
},
{
"digest": {
"length": 179.0,
"function_hash": "142929857341053955082865338708716824092"
},
"id": "PUB-A-179046129-b49778c3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/av/+/e69aac87d04a11d08df07a26dfd809b1478c27f6",
"target": {
"function": "ABuffer::setRange",
"file": "media/libstagefright/foundation/ABuffer.cpp"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/av/+/e69aac87d04a11d08df07a26dfd809b1478c27f6"
],
"types": [
"RCE"
],
"spl": "2021-06-01",
"severity": "Moderate"
}