Android kernel UVC driver out-of-bounds read enables local information disclosure

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.

• Android kernel: Marked affected by the supplied record. The relevant component is the UVC driver, but the record does not list specific Android release branches or kernel branches.
• Android security patch level: The Android bulletin places this issue in the group addressed by security patch level 2019-06-05. The bulletin states that security patch levels 2019-06-05 or higher address the issues associated with that group.
• Devices and OEMs: The Android bulletin marks the Android bug ID with *, indicating that the issue was not publicly available in the corresponding bug detail. It states that the update is generally contained in the latest binary drivers for Pixel devices, but this does not establish coverage for non-Pixel devices.
• The available evidence is insufficient to produce a complete list of affected models, kernel branches, or Android builds.

The affected component is the UVC driver, specifically uvc_parse_standard_control in uvc_driver.c. The record attributes the flaw to improper validation of input processed by the UVC parser. Invalid control data can cause the parser to read beyond the intended buffer boundary, resulting in an out-of-bounds read. The confirmed technical outcome is potential disclosure of data from kernel memory, not data modification or code execution. The available evidence does not establish the exact malformed input structure, related endpoint or ioctl, number of bytes that may be read, or every Android kernel branch that is affected.

• Reachability: Exploitation is local to the device, not network based.
• Privileges: Low local privileges are required according to the supplied attack characteristics; no additional execution privileges are needed.
• User interaction: Not required.
• Complexity: The supplied attack characteristics describe low complexity.
• Exploitation status: The record does not confirm a public exploit or active exploitation. The Android bulletin stated that it had no reports of active customer exploitation or abuse for the newly reported issues at bulletin publication. That statement is time-scoped and does not establish that exploitation could not occur later.

The flaw can allow a local application to read outside the intended buffer while UVC control data is being processed. The technical result is information disclosure from kernel memory, which may weaken application data isolation. The record does not show that the flaw directly provides integrity impact, availability impact, or code execution. Exploitation requires the ability to run code locally with low privileges, but does not require user interaction or additional execution privileges. The amount of data exposed and any path to a different impact are not established by the available evidence.

An affected device may expose sensitive kernel memory to a local application. The Android bulletin describes the consequence as a possible bypass of operating system protections that isolate application data from other applications. The evidence establishes information disclosure, but does not establish data modification, code execution, or service interruption. Actual exposure depends on the kernel shipped by the device manufacturer and whether the applicable update has been integrated.

1. Update the Android device to an OEM security update with security patch level 2019-06-05 or higher. The Android bulletin identifies this as the patch level group that addresses the issue.
2. After updating, check ro.build.version.security_patch and compare it with the patch level that the OEM confirms includes the UVC driver fix.
3. For Pixel devices, check for and install the corresponding binary driver or firmware update if the OEM distributes the fix through that channel.
4. If no update is available or the OEM has not confirmed the fix, treat the kernel as potentially affected and prioritize device replacement, isolation, or upgrade under the organization's endpoint policy. The available evidence does not establish an independent configuration workaround.
5. No exact fixed Android kernel release is provided in the record. Do not infer that parallel Android branches are unaffected merely because one patch level has been published.

• Inventory Android devices and identify kernel builds, with particular attention to builds that include the UVC driver.
• Check the value of ro.build.version.security_patch on each device and compare it with the security update level confirmed by the OEM.
• For Pixel devices, review the status of vendor-provided binary driver or firmware updates because the Android bulletin states that updates for issues marked as not publicly available are generally included in the latest Pixel binary drivers.
• Review kernel logs or telemetry for unusual kernel errors associated with UVC device handling, but treat this only as precautionary monitoring, not as a confirmed indicator of compromise.
• No specific log event, IOC, or malformed-data signature is provided. Absence of log evidence does not demonstrate that a device is safe.