CVE-2024-43768
Published: 03 January 2025
Description
In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Security Summary
CVE-2024-43768 is a vulnerability in the Skia graphics library, manifesting as an out-of-bounds write due to an integer overflow in the skia_alloc_func within SkDeflate.cpp. This issue affects the Android platform, specifically the external/skia component.
A local attacker with low privileges can exploit this vulnerability to achieve escalation of privilege, requiring no additional execution privileges or user interaction. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects its high impact potential on confidentiality, integrity, and availability for local users with straightforward exploitation conditions.
The Android Security Bulletin for December 2024 details the vulnerability and provides patches. A fix is implemented in commit b5543cb8c6b95623743016055220378efe73eb93 in the Android external Skia repository.
Details
- CWE(s)