OSV-2022-854

    Dashboard / Vulnerabilities / OSV-2022-854

    OSV-2022-854

    Published: 7 Sept 2022Last Modified: 20 Apr 2023

    Summary: Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51022 ``` Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor perfetto::trace_processor::TrackEventModule::ParsePacket perfetto::trace_processor::ProtoTraceParser::ParseTracePacketImpl ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51022

    Affected packages

    Package

    Name: perfetto

    Purl: pkg:generic/perfetto

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8209fb9b9a4156232aa87ad4621e541bfb777ec1
    Fixed -bb1b58e6d1d86b3122bb9574f2530093ff1cc2eb

    Affected versions

    android-13.0.0_r1
    android-13.0.0_r2
    android-13.0.0_r3
    android-13.0.0_r4
    android-13.0.0_r5
    android-13.0.0_r6
    android-13.0.0_r12
    android-13.0.0_r31
    android-13.0.0_r7
    android-13.0.0_r8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2022-854 | CVE-DB