Critical Android Security Vulnerability Let Remote Attacker Cause Permanent Denial of Service

Google released security updates for Android that deploy fixes for 15 vulnerabilities with severity level critical, high and moderate and another 22 vulnerabilities patched Qualcomm components.

The source code for the issues to be released with the Android Open Source Project (AOSP) repository and Google said that “partners notified about the issue before a month.”

Security Vulnerabilities

CVE-2019-2232

Among them, the most severe one is the security vulnerability with the Android framework component. The vulnerability can be tracked CVE-2019-2232, it allows a remote attacker to cause a permanent denial of service which may result in bricking of the phone.

The vulnerability can be exploited by a remote attacker using a specially crafted message without any user interaction. Improper input validation in handleRun of TextLine.java with the component Unicode Handler leads to denial of service with no user privileges.

Technical details of the vulnerability were not disclosed, Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2222

The vulnerability is classified as critical and it affects ihevcd_parse_slice_data of ihevcd_parse_slice.c function. It writes outside the bounds of allocated memory due to missing bounds check.

It may result in remote code execution and to exploit the vulnerability user interaction is required. Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2223

It affects ihevcd_ref_list of ihevcd_ref_list.c, another out of bounds write vulnerability due to missing bounds check. It allows an attacker to execute code remotely without any additional privileges. Android versions affected: 8.0/8.1/9.0/10.0.

Vulnerability Mitigation

The update for the patches depends upon the Android device manufacturer. The good news is that there are no current reports of these vulnerabilities exploited.

Samsung said that it is ” is releasing a maintenance release for major flagship models as part of the monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.”

LG has rolled out patches for December 2019 security bulletin, covering three critical security vulnerabilities.

Google said that “Google devices start receiving OTA updates on the same day the monthly bulletin is released. In general, it takes about one and a half calendar weeks for the OTA to reach every Google device.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.