CVE-2017-0758

Vulnerability

A remote code execution vulnerability exists in the Android media framework's libhevc component. The bug is a heap buffer overflow that can be triggered when processing a specially crafted media file. Affected versions include Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The vulnerability is identified as Android ID A-36492741 [1].

Exploitation

No authentication or user interaction beyond normal media playback is required. An attacker can deliver a malicious media file through web browsing, messaging, or any other channel where Android processes media. The vulnerable code path is reached when the libhevc decoder parses the crafted input, leading to a heap buffer overflow [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the media server process (mediaserver). This can lead to full compromise of the application's data and capabilities, potentially including access to sensitive information, with the elevated privileges of the media server [1].

Mitigation

Google released a security patch as part of the September 2017 Android Security Bulletin. The fix was included in the 2017-09-05 security patch level for the affected Android versions. Users should apply the update from their device vendor as soon as it becomes available [1].