  Android is the most used Operating System worldwide for mobile devices, with
hundreds of thousands of apps downloaded daily. Although these apps are
primarily written in Java and Kotlin, advanced functionalities such as graphics
or cryptography are provided through native C/C++ libraries. These libraries
can be affected by common vulnerabilities in C/C++ code (e.g., memory errors
such as buffer overflow), through which attackers can read/modify data or
execute arbitrary code. The detection and assessment of vulnerabilities in
Android native code have only been recently explored by previous research work.
In this paper, we propose a fast risk-based approach that provides a risk score
related to the native part of an Android application. In this way, before an
app is released, the developer can check if the app may contain vulnerabilities
in the Native Code and, if present, patch them to publish a more secure
application. To this end, we first use fast regular expressions to detect
library versions and possible vulnerable functions. Then, we apply scores
extracted from a vulnerability database to the analyzed application, thus
obtaining a risk score representative of the whole app. We demonstrate the
validity of our approach by performing a large-scale analysis on more than
$100,000$ applications (but only $40\%$ contained native code) and $15$ popular
libraries carrying known vulnerabilities. The attained results show that many
applications contain well-known vulnerabilities that miscreants can potentially
exploit, posing serious concerns about the security of the whole Android
applications landscape.
