Understanding CVE-2023-40085: Out of Bounds Read in convertSubgraphFromHAL of ShimConverter.cpp

In the realm of cybersecurity, vulnerabilities are discovered frequently, and it's important to be aware of these to protect and secure our systems. In this long-form post, we'll discuss CVE-2023-40085, a security vulnerability that has been recently reported. This vulnerability exists in the convertSubgraphFromHAL function within ShimConverter.cpp and has the potential for an out of bounds read due to missing bounds checks. By exploiting this vulnerability, an attacker can gain access to local information disclosure without any additional execution privileges, and user interaction is not necessary for exploitation. We will delve into the details of this vulnerability, review the problematic code, and discuss the exploit details while providing links to various references.

An Overview of the Vulnerability

CVE-2023-40085 is a vulnerability that affects the convertSubgraphFromHAL function in the ShimConverter.cpp file. The root cause of this vulnerability is a missing bounds check, which, if exploited, can lead to an out of bounds read. In simpler terms, this means that a malicious actor could potentially access data that should not be available to them and use this information to leverage further attacks.

The vulnerable code snippet is shown below

int convertSubgraphFromHAL(const void *data, size_t length, Subgraph *subgraph) {
    // ...

    int32_t operationCount;
    memcpy(&operationCount, dataPtr, sizeof(int32_t));
    dataPtr += sizeof(int32_t);

    subgraph->operations.resize(operationCount);
    for (int i = ; i < subgraph->operationCount; i++) {
        const Operation *from = static_cast<const Operation *>(static_cast<const void *>(dataPtr));

        // ... Some manipulations

        if (someCondition) {
            uint32_t value;
            memcpy(&value, dataPtr + offsetof(Operation, inputs) + from->inputCount * sizeof(uint32_t), sizeof(uint32_t));
            subgraph->operands[from->inputs[value]].lifetime = static_cast<OperandLifeTime>(value);
        }

        dataPtr += sizeof(Operation) + sizeof(uint32_t) * (from->inputCount + from->outputCount);

        // ... More code
    }
}

As we can see from the code snippet, there is no bounds check before accessing the hal.4._2._1.Operation data structure's input array. This can lead to an out of bounds read if a maliciously crafted data structure were to be passed to the function.

This vulnerability was originally discovered and reported by the following sources

1. Google's Android Security Bulletin - The official Android Security Bulletin includes details on this and other vulnerabilities.
2. NIST National Vulnerability Database (CVE-2023-40085) - The NIST NVD entry provides a comprehensive analysis of the vulnerability.

Exploiting the Vulnerability

Although user interaction is not necessary for exploitation, an attacker would still need to craft a malicious data structure to exploit the vulnerability. It could be delivered through various attack vectors such as email attachments, social engineering, or by exploiting another vulnerability in an application that processes data with convertSubgraphFromHAL function. Once this malicious data structure is provided to the function, it could potentially lead to sensitive information disclosure, as the attacker would gain access to the data found in the out of bounds memory read.

In Summary

CVE-2023-40085 is a vulnerability that has the potential for local information disclosure due to an out of bounds read caused by a missing bounds check in the convertSubgraphFromHAL function in ShimConverter.cpp. This vulnerability is problematic, as it does not require additional execution privileges or user interaction. Therefore, it's crucial for systems employing this function to ensure that proper bounds checks are in place and ensure that the vulnerable code is patched to minimize risk.

Timeline

Published on: 02/16/2024 19:15:08 UTC
Last modified on: 02/16/2024 19:26:55 UTC