{"id":"ASB-A-370840874","details":"In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-370840874","CVE-2024-49738"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-01-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-01-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/f3c7aac0e3277f7ebabaab94f34b5c9156412cc9"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-01-01"}]}],"versions":["15-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/c54dad65317f851ce9d016bd90ec6a7a04da09fc"],"severity":"High","spl":"2025-01-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/c54dad65317f851ce9d016bd90ec6a7a04da09fc","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeObject"},"deprecated":false,"digest":{"function_hash":"297814362107445610082654090359809384968","length":1582},"exact_target_file_match_only":true,"id":"ASB-A-370840874-2d3a29cc","signature_type":"Function","signature_version":"v1"},{"target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeInplace"},"deprecated":false,"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-6c446f38","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/c54dad65317f851ce9d016bd90ec6a7a04da09fc"},{"deprecated":false,"digest":{"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","5459374701110884002122948635842376246","139485230588671050701757286638303746782","27515442413792563850244456883337050092","338273689907845506080366789303687789672","94325907291901409267573572028677659775","334268703811797312539685279166094187699","177929807823366295858787852042555989520","272508042470490873432018013596229747742"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-370840874-e392a48c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/c54dad65317f851ce9d016bd90ec6a7a04da09fc","target":{"file":"libs/binder/Parcel.cpp"}},{"target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeAligned"},"deprecated":false,"digest":{"function_hash":"293563029431163384534579630592325398310","length":471},"exact_target_file_match_only":true,"id":"ASB-A-370840874-e585bc20","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/c54dad65317f851ce9d016bd90ec6a7a04da09fc"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2025-01-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2025-01-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","297459603371341219306139209616668062751","246036501175084741583285991937705244678","27515442413792563850244456883337050092","338273689907845506080366789303687789672","250172505421581400181205564251316004121","339718309363086333322952185827518444964","147461113591116849175667398032374209803","154795782594771188218202105235844049986"]},"exact_target_file_match_only":true,"id":"ASB-A-370840874-26cf92f8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeObject"},"deprecated":false,"digest":{"function_hash":"94828663791970858100698628675736531893","length":1174},"exact_target_file_match_only":true,"id":"ASB-A-370840874-3486245c","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeInplace"},"deprecated":false,"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-72507174","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeAligned"},"deprecated":false,"digest":{"function_hash":"172039250980780037644587941896111450844","length":416},"exact_target_file_match_only":true,"id":"ASB-A-370840874-f1aca62a"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2025-01-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d"],"severity":"High","spl":"2025-01-01","types":["EoP"],"vanir_signatures":[{"exact_target_file_match_only":true,"id":"ASB-A-370840874-0fb16d06","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","297459603371341219306139209616668062751","246036501175084741583285991937705244678","27515442413792563850244456883337050092","338273689907845506080366789303687789672","250172505421581400181205564251316004121","339718309363086333322952185827518444964","147461113591116849175667398032374209803","154795782594771188218202105235844049986"],"threshold":0.9}},{"exact_target_file_match_only":true,"id":"ASB-A-370840874-81134aac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"function":"Parcel::writeObject","file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"function_hash":"94828663791970858100698628675736531893","length":1174}},{"deprecated":false,"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-9294a6e1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"function":"Parcel::writeInplace","file":"libs/binder/Parcel.cpp"}},{"source":"https://android.googlesource.com/platform/frameworks/native/+/2aec032c0826ad68cd94c100173b99167bfcb10d","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeAligned"},"deprecated":false,"digest":{"function_hash":"172039250980780037644587941896111450844","length":416},"exact_target_file_match_only":true,"id":"ASB-A-370840874-cade1a99","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-01-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-01-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"293563029431163384534579630592325398310","length":471},"exact_target_file_match_only":true,"id":"ASB-A-370840874-55796520","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/43feae49c343b948a38b15d5e12c78916bafee61","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeAligned"},"deprecated":false},{"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-c6dd35d0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/43feae49c343b948a38b15d5e12c78916bafee61","target":{"function":"Parcel::writeInplace","file":"libs/binder/Parcel.cpp"},"deprecated":false},{"target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeObject"},"deprecated":false,"digest":{"function_hash":"297814362107445610082654090359809384968","length":1582},"exact_target_file_match_only":true,"id":"ASB-A-370840874-d291a540","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/43feae49c343b948a38b15d5e12c78916bafee61"},{"digest":{"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","5459374701110884002122948635842376246","139485230588671050701757286638303746782","27515442413792563850244456883337050092","338273689907845506080366789303687789672","94325907291901409267573572028677659775","334268703811797312539685279166094187699","177929807823366295858787852042555989520","272508042470490873432018013596229747742"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-370840874-d760f237","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/43feae49c343b948a38b15d5e12c78916bafee61","target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/43feae49c343b948a38b15d5e12c78916bafee61"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-01-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1"],"severity":"High","spl":"2025-01-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeObject"},"deprecated":false,"digest":{"length":1154,"function_hash":"175000366554730585123907779373568441240"},"exact_target_file_match_only":true,"id":"ASB-A-370840874-9bff609b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1"},{"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-b1ae812a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"function":"Parcel::writeInplace","file":"libs/binder/Parcel.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeAligned"},"deprecated":false,"digest":{"function_hash":"293563029431163384534579630592325398310","length":471},"exact_target_file_match_only":true,"id":"ASB-A-370840874-b1f00902","signature_type":"Function"},{"id":"ASB-A-370840874-d5cb983e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","297459603371341219306139209616668062751","246036501175084741583285991937705244678","27515442413792563850244456883337050092","338273689907845506080366789303687789672","94325907291901409267573572028677659775","334268703811797312539685279166094187699","177929807823366295858787852042555989520","272508042470490873432018013596229747742"]},"exact_target_file_match_only":true}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-01-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"175000366554730585123907779373568441240","length":1154},"exact_target_file_match_only":true,"id":"ASB-A-370840874-5a1968e2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeObject"},"deprecated":false},{"target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::writeInplace"},"deprecated":false,"digest":{"function_hash":"8618114329319310912930896519838241565","length":774},"exact_target_file_match_only":true,"id":"ASB-A-370840874-89487df9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"function":"Parcel::writeAligned","file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"function_hash":"293563029431163384534579630592325398310","length":471},"exact_target_file_match_only":true,"id":"ASB-A-370840874-cc7b2381"},{"deprecated":false,"digest":{"line_hashes":["177286139698374251546338520979178803929","263777811521303244292811673748167317299","306631319605809265062590238010977363154","297459603371341219306139209616668062751","246036501175084741583285991937705244678","27515442413792563850244456883337050092","338273689907845506080366789303687789672","94325907291901409267573572028677659775","334268703811797312539685279166094187699","177929807823366295858787852042555989520","272508042470490873432018013596229747742"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-370840874-f0bc538d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1","target":{"file":"libs/binder/Parcel.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/4e76d6907ec1e8f065f7af3e4032e4b8cee6b2c1"],"severity":"High","spl":"2025-01-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-370840874.json"}}],"schema_version":"1.9.0"}