What is CVE-2014-3100?

CVE-2014-3100 is a vulnerability in Google Android, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-07-02.

Is CVE-2014-3100 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Google Android

CVE-2014-3100

Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name.

Vulnerability class: Buffer Overflow

EPSS: 0.018 (75.6th percentile) — read the EPSS interpretation.

Affected products

Google Android — versions 4.3
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

psirt@us.ibm.com (x_refsource_MISC)
psirt@us.ibm.com (mailing-list, x_refsource_BUGTRAQ)
psirt@us.ibm.com (vdb-entry, x_refsource_BID)
psirt@us.ibm.com (Exploit, x_refsource_MISC)
psirt@us.ibm.com (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2014-3100?: CVE-2014-3100 is a vulnerability in Google Android, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-07-02.
Is CVE-2014-3100 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.