vendor:
Android
by:
Project Zero
7,8
CVSS
HIGH
Heap Address Leak
119
CWE
Product Name: Android
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Android
2017
Interaction between kernel /dev/binder and usermode Parcel.cpp
When a binder object is passed as BINDER_TYPE_BINDER or BINDER_TYPE_WEAK_BINDER, a pointer to that object (in the server process) is leaked to the client process as the cookie value. This leads to a leak of a heap address in many of the privileged binder services, including system_server.
Mitigation:
Ensure that binder objects are not passed as BINDER_TYPE_BINDER or BINDER_TYPE_WEAK_BINDER.
