In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure over NFC with System execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/apps/Nfc/+/d0036c14c0a6da7f0567f90052ecbbd4657e42f5"
],
"severity": "Moderate",
"spl": "2021-12-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "PUB-A-181346545-3dc4e98f",
"digest": {
"length": 1127.0,
"function_hash": "172923655756302291063356266705277028508"
},
"source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/d0036c14c0a6da7f0567f90052ecbbd4657e42f5",
"signature_type": "Function",
"target": {
"file": "nci/jni/HciEventManager.cpp",
"function": "HciEventManager::nfaHciCallback"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "PUB-A-181346545-ac6d5093",
"digest": {
"line_hashes": [
"318035084337290619674740155915310510867",
"86137731946867326805606705081369926130",
"286564177019519813437093599060059642402",
"11876562026318324878696478696135779449",
"113336880759440159700332416151799658294",
"314195783414381717693130490562681532941",
"199756952328838585389425144633112623955",
"93734117183106986541042974404983304804",
"78843905427150278030523467609738593472",
"44625852898386418973852311755032259448",
"70069643358981674564266814711647675555",
"278693986712162930792261506515603221196",
"269054370538398151964396198189849018763",
"221760561883641550706662575064371821485",
"8800284596126465199717721093475055653",
"283554715526979460669321300352238192783",
"306863464749530576741797108917293002611",
"243786863521775750259705421927072140392"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/packages/apps/Nfc/+/d0036c14c0a6da7f0567f90052ecbbd4657e42f5",
"signature_type": "Line",
"target": {
"file": "nci/jni/HciEventManager.cpp"
}
}
],
"types": [
"ID"
]
}