Stack-based buffer overflow and memory disclosure in camera driver (CVE-2013-4738 CVE-2013-4739)

Release Date: 
October 15, 2013
Affected Projects: 
Advisory ID: 

A stack-based buffer overflow and a kernel memory disclosure vulnerability have been discovered in the system call handlers of the camera driver.

The camera post processing engine (CPP) and video processing engine (VPE) provide an ioctl system call interface to user space clients for communication. When processing arguments passed to the VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user space supplied length value is used to copy memory to a local stack buffer without proper bounds checking. An application with access to the respective device nodes can use this flaw to, e.g., elevate privileges.

Access Vector: local
Security Risk: high
Vulnerability: CWE-121 (stack-based buffer overflow)

The Gemini JPEG encoder and the Jpeg1.0 common encoder/decoder engines of the camera driver are not properly initializing all members of a structure before copying it to user space. This allows a local attacker to obtain potentially sensitive information from kernel stack memory via ioctl system calls.

Access Vector: local
Security Risk: low
Vulnerability: CWE-200 (information exposure)

Affected versions
All Android releases from CAF using the Linux kernel from the following heads:

  • msm-3.4
  • jb_3*

Qualcomm Innovation Center, Inc. (QuIC) thanks Jonathan Salwan of the Sysdream Security Lab for reporting the related issues and working with QuIC to help improve Android device security.


Initial revision