CVE-2017-0543

Vulnerability

The vulnerability resides in the libavc library, specifically in the H.264 decoder component of Mediaserver. The function ih264d_parse_slice.c fails to initialize default reference buffers for each picture before decoding the first slice. This lack of initialization can lead to memory corruption when processing a specially crafted media file. Affected versions: Android 6.0, 6.0.1, 7.0, and 7.1.1. [1][2]

Exploitation

An attacker needs to deliver a specially crafted media file (e.g., via a malicious application or web content) that targets the Mediaserver process. No additional privileges are required if the file is processed by Mediaserver. The attacker can trigger the vulnerability by having the user open the crafted file, causing Mediaserver to parse it and trigger the uninitialized reference buffer, leading to memory corruption. [1]

Impact

Successful exploitation allows arbitrary code execution within the context of the Mediaserver process, which runs with high privileges. This could enable an attacker to potentially install programs; view, change, or delete data; or create new accounts with full user rights. The impact is rated as Critical due to remote code execution possibility. [1]

Mitigation

A fix was provided in the Android Security Bulletin for April 2017. The commit with ID f634481e940421020e52f511c1fb34aac1db4b2f initializes default reference buffers for all pictures, preventing the memory corruption. Users should update to the latest security patch level. No workarounds are mentioned. [1][2]