Samsung SveService Native Out-of-Bounds Write (CVE-2026-21018)

Metadata

Affected Target

Summary

CVE-2026-21018 is an out-of-bounds write in the Samsung system service SveService, which runs as system (UID 1000) and is registered directly via ServiceManager.addService() — bypassing Android’s normal signatureOrSystem permission enforcement, so it is reachable without any special permission. The exposed sveSetCodecInfo Binder transaction (code 38) passes three caller-controlled length parameters straight into the native function sveJNISVE_SetCodecInfo in libsvejni.so, which uses them unchecked as arguments to memset, a stack alloca, and memcpy. Unlike sibling functions in the same library that validate their length arguments against a 30-byte cap, SetCodecInfo performs no validation at all, so a caller-supplied value of -1 (0xFFFFFFFF) causes the service to attempt to zero/copy gigabytes-to-exabytes of memory, corrupting the stack and crashing the service. The PoC drives this transaction directly via reflection-based ServiceManager/Parcel calls from an app_process shell.

Vulnerability Details

Root Cause

In sveJNISVE_SetCodecInfo (libsvejni.so, offset 0x21710), the three integer parameters received from the AIDL call (sveSetCodecInfo, Binder transaction 38) are used directly as size arguments to memset, a stack-adjusting sub sp, sp, xN (effectively alloca), and memcpy, with no bounds checking. Sibling native functions in the same library (GetVersion, EnableSRTP, SetSRTPParams, SetGcmSrtpParams) validate their equivalent length parameter with cmp w20, #0x1e; b.gt (rejecting values greater than 30 bytes); SetCodecInfo omits this check entirely. Supplying -1 yields a memset count of 0xFFFFFFFF (~4 GB) and a sign-extended memcpy length of 0xFFFFFFFFFFFFFFFF, corrupting the stack pointer and crashing the process (confirmed via tombstone: SIGSEGV/SEGV_MAPERR in __memset_aarch64 called from sveJNISVE_SetCodecInfo+504).

Attack Vector

1. Attacker obtains a Binder reference to SveService via ServiceManager.getService("SveService") — no root or special permission required; works from an app_process shell (shell UID).
2. Attacker builds a Parcel matching the ISecVideoEngineService AIDL layout for sveSetCodecInfo (transaction code 38), including the three vulnerable length fields.
3. Attacker sends a baseline call with small valid lengths (1,1,1) to confirm connectivity.
4. Attacker sends a second call with the length fields set to -1, which reaches sveJNISVE_SetCodecInfo in libsvejni.so and triggers unchecked memset/alloca/memcpy operations with attacker-controlled sizes.
5. The service crashes (DeadObjectException observed by the caller), confirming the out-of-bounds write; with an address leak and a ROP chain (no PAC on the tested SM-A175F), this primitive could plausibly be escalated toward arbitrary code execution as system.

Impact

A local unprivileged (shell-level) caller can reliably crash the privileged system-context SveService, and the underlying unchecked-length memory corruption primitive is a plausible building block for local privilege escalation to system given further exploitation (address leak + ROP).

Environment / Lab Setup

Target:   Samsung Android device running SveService/libsvejni.so prior to SMR May-2026 Release 1 (tested: Galaxy A17 LTE, SM-A175F)
Attacker: Host PC with Android SDK (ANDROID_HOME/ANDROID_SDK_ROOT), platform android-36 jar, d8 build tool, and adb; device reachable via adb

Proof of Concept

PoC Script

See SveServiceExploit.java, build_and_run.sh, libsvejni.so, and sveservice.apk in this folder.

1

./build_and_run.sh

build_and_run.sh compiles SveServiceExploit.java against the Android 36 platform jar, converts it to a classes.dex with d8, pushes it to /data/local/tmp, and runs it on-device via app_process. The exploit first issues a benign sveSetCodecInfo call with lengths (1,1,1) to confirm the transaction succeeds, then repeats the call with lengths (-1,-1,-1), which crashes SveService with a DeadObjectException, confirming the out-of-bounds write.

Detection & Indicators of Compromise

Signs of compromise:

• Tombstones referencing libsvejni.so with stack pointer in a non-existent memory map (“stack overflow”-style SIGSEGV).
• Repeated unexplained restarts of SveService correlated with Binder transaction code 38 (sveSetCodecInfo) from low-privilege UIDs.
• Unusual app_process/reflection-based ServiceManager.getService activity from shell-level processes.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Filipemendonca1978/CVE-2026-21018 on 2026-07-05.