CVE-2017-0591

Vulnerability

A remote code execution vulnerability exists in libavc, the software H.264/AVC decoder used by Android's Mediaserver. The bug is in the ih264d_utils.c file and stems from improper error handling when processing dangling fields with gaps in frames enabled; the field picture in cur_slice is incorrectly set to zero, causing subsequent memory operations to corrupt heap memory. Affected Android versions: 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2 [1][2].

Exploitation

An attacker must deliver a specially crafted media file to a vulnerable device, convincing the user to open it (e.g., via MMS, email, or a malicious app). No additional privileges are required. When Mediaserver parses the file, the flawed error-handling path in the decoder triggers a memory corruption that can be leveraged to hijack control flow [1].

Impact

Successful exploitation yields arbitrary code execution within the context of the Mediaserver process, which runs with high privileges. This can lead to full compromise of the media pipeline and potentially enable elevation of privilege or further system access. The vulnerability does not require user interaction beyond opening the crafted file [1].

Mitigation

Google released fixes as part of the May 2017 Android Security Bulletin [1]. The fix is identified in commit 5c3fd5d93a268abb20ff22f26009535b40db3c7d and was cherry-picked from commit 1a13168ca3510ba91274d10fdee46b3642cc9554 [2]. Users should apply the 2017-05-01 security patch level or later. No workaround is available; the vulnerability is not listed on CISA's KEV as of this writing.