full-disclosure - [FD] CVE-2021-39623 Libstagefright (Media Framework on Android) with OOB write on the heap

Open Source and information security mailing list archives

Message-ID: <CAP6wrbV9RAtxMAAC=voUzLp1sYqigtu5M7_zojqJKZ-rddH0NA@mail.gmail.com>
Date: Tue, 11 Jan 2022 10:08:57 +0100
From: Marcin Kozlowski <marcinguy@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2021-39623 Libstagefright (Media Framework on Android)
 with OOB write on the heap

Hi list,

Maybe you will find it interesting.

Forcedentry state of the art exploit (as I read) used by NSO made it
big. Libstagefright (Media Framework on Android) with OOB write on the
heap (with Scudo) which can possibly own your Mobile by playing an
audio file, didn't. Note: Not sure if you can do RCE with it. Leave it
to experts :P

Here is the repo with reporoducer and possibly also code in the future
to create it when needed.

https://github.com/marcinguy/CVE-2021-39623

Thanks,
Marcin

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives