CVE-2017-13232
HIGHAndroid 5.1.1-8.1 - Local Information Disclosure via Audioserver Log Statement
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-13232. PoCs published by codecat007.
AI-analyzed exploit summary This PoC exploits CVE-2017-13232, a vulnerability in Android's audio policy service. It crafts a malicious `audio_attributes_t` structure with an oversized `tags` field to trigger a buffer overflow during a `GET_OUTPUT_FOR_ATTR` transaction.
Description
In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68953950.
Exploits (1)
This PoC exploits CVE-2017-13232, a vulnerability in Android's audio policy service. It crafts a malicious `audio_attributes_t` structure with an oversized `tags` field to trigger a buffer overflow during a `GET_OUTPUT_FOR_ATTR` transaction.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N