PT-2017-1102 · Google · Android Kernel

Publicado 2017-01-12 · Atualizado 2017-01-23 · CVE-2016-8440

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android Kernel versions 3.18

Description The issue is related to a possible buffer overflow in the SMMU system call, caused by improper input validation in the ADSP SID2CB system call. This may result in the hypervisor memory being overwritten. The exploitation of this issue could allow a remote attacker to cause damage by overwriting the hypervisor memory due to incorrect input validation.

Recommendations For Android Kernel version 3.18, consider applying proper input validation to the ADSP SID2CB system call to prevent potential buffer overflows. As a temporary workaround, restrict access to the SMMU system call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2017-00195

CVE-2016-8440

Produtos afetados

Android Kernel

Referências · 5

• https://source.android.com/security/bulletin/2017-01-01.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8440 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8440 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-00195 · Nota de Segurança
• http://securityfocus.com/bid/95227 · Nota