CVE-2024-0018 Overview
CVE-2024-0018 is a heap buffer overflow vulnerability in the convertYUV420Planar16ToY410 function of ColorConverter.cpp in the Android media framework. The flaw allows an out-of-bounds write during YUV to Y410 color space conversion. Successful exploitation enables local privilege escalation on affected devices without requiring user interaction or additional execution privileges. The vulnerability affects Android versions 11 through 14 and was addressed in the January 2024 Android Security Bulletin. The weakness is categorized under [CWE-787] (Out-of-bounds Write) and [CWE-122] (Heap-based Buffer Overflow).
Critical Impact
Local attackers can achieve privilege escalation through a heap buffer overflow in the Android media framework without user interaction.
Affected Products
- Google Android 11.0
- Google Android 12.0 and 12.1
- Google Android 13.0 and 14.0
Discovery Timeline
- 2024-01-01 - Android Security Bulletin published with patch reference
- 2024-02-16 - CVE-2024-0018 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0018
Vulnerability Analysis
The vulnerability resides in the convertYUV420Planar16ToY410 function within ColorConverter.cpp, part of the Android media framework at frameworks/av. This function converts 16-bit planar YUV 4:2:0 video data into the packed Y410 format used for 10-bit HDR content rendering. During conversion, the routine fails to properly validate buffer boundaries when writing transformed pixel data to the destination heap allocation.
Because the media framework processes untrusted video content across multiple Android services, an attacker who can supply crafted media parameters or frames can trigger a write past the end of an allocated heap buffer. The overflow corrupts adjacent heap metadata or object pointers within the media server process, which provides an avenue for local privilege escalation.
Root Cause
The root cause is missing or incorrect bounds checking on the destination buffer size relative to the input frame dimensions in convertYUV420Planar16ToY410. When the calculated output size exceeds the allocated buffer, the routine continues writing converted Y410 samples past the buffer boundary. The upstream fix, applied in commit bf6406041919f67219fd1829438dda28845d4c23, corrects the length calculation and boundary handling for planar-to-packed conversion.
Attack Vector
Exploitation requires local access with low privileges. An attacker delivers a crafted media file or stream that a privileged media component decodes, triggering the vulnerable color conversion path. The overflow occurs entirely within the media server context, so no user interaction is required beyond loading the malicious content through a supporting application or codec pipeline.
No verified public proof-of-concept is available. See the Google Source Security Patch for the corrected implementation.
Detection Methods for CVE-2024-0018
Indicators of Compromise
- Unexpected crashes or tombstones referencing libstagefright, mediaserver, or ColorConverter in /data/tombstones/.
- SIGSEGV or SIGABRT signals raised by media codec processes when parsing YUV 10-bit content.
- Anomalous child processes spawned by media framework services following media playback.
Detection Strategies
- Monitor Android device logs (logcat) for repeated crashes in media.codec or media.swcodec processes.
- Inspect installed applications for those requesting broad media or codec access without a legitimate need.
- Correlate device patch level (ro.build.version.security_patch) against the January 2024 bulletin baseline to identify unpatched fleet devices.
Monitoring Recommendations
- Deploy mobile threat defense agents that flag exploitation attempts against media framework components.
- Enroll devices in mobile device management to enforce patch-level compliance and quarantine non-compliant endpoints.
- Ingest crash telemetry from managed Android devices into a central SIEM for anomaly analysis.
How to Mitigate CVE-2024-0018
Immediate Actions Required
- Apply the Android security patch level 2024-01-01 or later on all affected devices.
- Prioritize patching for devices running Android 11 through 14 that process untrusted media content.
- Restrict installation of applications from untrusted sources through MDM policy.
Patch Information
The fix is committed to the Android Open Source Project in frameworks/av at revision bf6406041919f67219fd1829438dda28845d4c23 and is included in the Android Security Bulletin January 2024. Device manufacturers integrate the patch into vendor-specific over-the-air updates. Confirm the applied security patch level in device settings under About phone > Android security update.
Workarounds
- Avoid opening media files from untrusted sources on unpatched devices until the January 2024 or later security update is applied.
- Disable auto-download of media in messaging applications on devices that cannot receive vendor patches.
- Retire end-of-life devices that no longer receive security updates from the manufacturer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
