{"id":"ASB-A-243463593","details":"In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-243463593","CVE-2023-40110"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2023-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2023-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/av/+/53243faf690a49e00952b3d3956d2fff0b8d4a3c"}],"affected":[{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-11-01"}]}],"versions":["11"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44"],"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt32"},"deprecated":false,"digest":{"length":222,"function_hash":"29132274659906287857202031673365486865"},"id":"ASB-A-243463593-131eb36e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44"},{"target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt16"},"deprecated":false,"digest":{"function_hash":"34154390763950867467417999733978382884","length":175},"id":"ASB-A-243463593-19c95ffa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44"},{"id":"ASB-A-243463593-3ef074ae","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44","target":{"function":"MtpPacket::putUInt32","file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"length":299,"function_hash":"298372404400044685788784117800346771880"}},{"id":"ASB-A-243463593-4e42e0e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44","target":{"file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"line_hashes":["10360648252606816404717437669470675893","227011160605173160719128045050766853883","208164841370806985723361759329080856329","71364014207097319227882820800460492904","156243055800073920013120214974781898386","215156572296132505262246123742587744241","7069884085968848656412683427367043296","235743035146536230866436624450904495228","35290295899257055203805651232869540931","207937354798362552360337160529413393744","78996111740133474014844433096763461624","334443121837729838277033742941280569682","68681804946192098603078887479391740954","294638057278564561348433337879369379523","297908863031311931518915486339596470465","110154676319333325261637695499784063818","34446191657970144545577341729483614203","314457986449180959672199800767823662525"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/1401a723899766632363129265b30d433ac69c44","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt16"},"deprecated":false,"digest":{"function_hash":"315466067567656958854029971084270982926","length":134},"id":"ASB-A-243463593-a36956be","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243463593.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-11-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80"],"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt32"},"deprecated":false,"digest":{"function_hash":"29132274659906287857202031673365486865","length":222},"id":"ASB-A-243463593-106c583f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt32"},"deprecated":false,"digest":{"length":299,"function_hash":"298372404400044685788784117800346771880"},"id":"ASB-A-243463593-3e24f9e3","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-243463593-8cc5857e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80","target":{"function":"MtpPacket::getUInt16","file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"length":134,"function_hash":"315466067567656958854029971084270982926"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80","target":{"file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["10360648252606816404717437669470675893","227011160605173160719128045050766853883","208164841370806985723361759329080856329","71364014207097319227882820800460492904","156243055800073920013120214974781898386","215156572296132505262246123742587744241","7069884085968848656412683427367043296","235743035146536230866436624450904495228","35290295899257055203805651232869540931","207937354798362552360337160529413393744","78996111740133474014844433096763461624","334443121837729838277033742941280569682","68681804946192098603078887479391740954","294638057278564561348433337879369379523","297908863031311931518915486339596470465","110154676319333325261637695499784063818","34446191657970144545577341729483614203","314457986449180959672199800767823662525"]},"id":"ASB-A-243463593-acd5f0a8","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"34154390763950867467417999733978382884","length":175},"id":"ASB-A-243463593-be12766d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/38a83caefc4b5fd5aa1071bbabf0c71f49e6ac80","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt16"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243463593.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-11-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-243463593-636357b2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f","target":{"file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"line_hashes":["10360648252606816404717437669470675893","227011160605173160719128045050766853883","208164841370806985723361759329080856329","71364014207097319227882820800460492904","156243055800073920013120214974781898386","215156572296132505262246123742587744241","7069884085968848656412683427367043296","235743035146536230866436624450904495228","35290295899257055203805651232869540931","207937354798362552360337160529413393744","78996111740133474014844433096763461624","334443121837729838277033742941280569682","68681804946192098603078887479391740954","294638057278564561348433337879369379523","297908863031311931518915486339596470465","110154676319333325261637695499784063818","34446191657970144545577341729483614203","314457986449180959672199800767823662525"],"threshold":0.9}},{"id":"ASB-A-243463593-6e4e0021","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt16"},"deprecated":false,"digest":{"function_hash":"315466067567656958854029971084270982926","length":134}},{"id":"ASB-A-243463593-733a088c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt16"},"deprecated":false,"digest":{"length":175,"function_hash":"34154390763950867467417999733978382884"}},{"deprecated":false,"digest":{"function_hash":"29132274659906287857202031673365486865","length":222},"id":"ASB-A-243463593-79a58389","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt32"}},{"source":"https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f","target":{"function":"MtpPacket::putUInt32","file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"length":299,"function_hash":"298372404400044685788784117800346771880"},"id":"ASB-A-243463593-ae4e69e4","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/28dfceb42b04c86000146bcc8731d976028c247f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243463593.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-11-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"298372404400044685788784117800346771880","length":299},"id":"ASB-A-243463593-1856909b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9","target":{"function":"MtpPacket::putUInt32","file":"media/mtp/MtpPacket.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9","target":{"file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"line_hashes":["10360648252606816404717437669470675893","227011160605173160719128045050766853883","208164841370806985723361759329080856329","71364014207097319227882820800460492904","156243055800073920013120214974781898386","215156572296132505262246123742587744241","7069884085968848656412683427367043296","235743035146536230866436624450904495228","35290295899257055203805651232869540931","207937354798362552360337160529413393744","78996111740133474014844433096763461624","334443121837729838277033742941280569682","68681804946192098603078887479391740954","294638057278564561348433337879369379523","297908863031311931518915486339596470465","110154676319333325261637695499784063818","34446191657970144545577341729483614203","314457986449180959672199800767823662525"],"threshold":0.9},"id":"ASB-A-243463593-1bc6929f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt16"},"deprecated":false,"digest":{"function_hash":"315466067567656958854029971084270982926","length":134},"id":"ASB-A-243463593-8fcfb983","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt16"},"deprecated":false,"digest":{"function_hash":"34154390763950867467417999733978382884","length":175},"id":"ASB-A-243463593-912c9eb8"},{"source":"https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt32"},"deprecated":false,"digest":{"function_hash":"29132274659906287857202031673365486865","length":222},"id":"ASB-A-243463593-a5584b6f","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/av/+/0c26c2f4595b58bd7a11512227eacd480c4ddcd9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243463593.json"}},{"package":{"name":"platform/frameworks/av","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2023-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518"],"severity":"High","spl":"2023-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-243463593-567ee785","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::getUInt32"},"deprecated":false,"digest":{"length":222,"function_hash":"29132274659906287857202031673365486865"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518","target":{"function":"MtpPacket::putUInt32","file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"function_hash":"298372404400044685788784117800346771880","length":299},"id":"ASB-A-243463593-6901ad47"},{"digest":{"line_hashes":["10360648252606816404717437669470675893","227011160605173160719128045050766853883","208164841370806985723361759329080856329","71364014207097319227882820800460492904","156243055800073920013120214974781898386","215156572296132505262246123742587744241","7069884085968848656412683427367043296","235743035146536230866436624450904495228","35290295899257055203805651232869540931","207937354798362552360337160529413393744","78996111740133474014844433096763461624","334443121837729838277033742941280569682","68681804946192098603078887479391740954","294638057278564561348433337879369379523","297908863031311931518915486339596470465","110154676319333325261637695499784063818","34446191657970144545577341729483614203","314457986449180959672199800767823662525"],"threshold":0.9},"id":"ASB-A-243463593-708f4159","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518","target":{"file":"media/mtp/MtpPacket.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518","target":{"function":"MtpPacket::getUInt16","file":"media/mtp/MtpPacket.cpp"},"deprecated":false,"digest":{"function_hash":"315466067567656958854029971084270982926","length":134},"id":"ASB-A-243463593-969690c3","signature_type":"Function"},{"deprecated":false,"digest":{"length":175,"function_hash":"34154390763950867467417999733978382884"},"id":"ASB-A-243463593-e1ceb256","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/av/+/56ae070c55debb8b2c691e296bded3d6e9f63518","target":{"file":"media/mtp/MtpPacket.cpp","function":"MtpPacket::putUInt16"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-243463593.json"}}],"schema_version":"1.9.0"}