PT-2017-19118 · Qualcomm+3 · Qrd Android+3

Publicado 2017-10-10 · Atualizado 2017-10-19 · CVE-2017-9697

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android for MSM versions (affected versions not specified) Firefox OS for MSM versions (affected versions not specified) QRD Android versions (affected versions not specified)

Description A race condition exists that can allow access to already freed memory while reading command registration table entries in diag dbgfs read table. This issue affects Android releases from CAF using the Linux kernel.

Recommendations For Android for MSM, consider restricting access to the diag dbgfs read table function until a patch is available. For Firefox OS for MSM, avoid using the diag dbgfs read table function in sensitive operations until the issue is resolved. For QRD Android, as a temporary workaround, consider disabling the diag dbgfs read table function until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2017-9697

Produtos afetados

Android

Firefox Os

Linux Kernel

Qrd Android

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-9697 · Aviso do Fabricante
• http://securityfocus.com/bid/101160 · Nota
• https://source.android.com/security/bulletin/pixel/2017-10-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9697 · Nota de Segurança