PT-2017-2313 · Linux+1 · Linux Kernel+1

Roee Hay + 1 · Publicado 2017-06-14 · Atualizado 2019-10-03 · CVE-2017-0648

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 3.10 Android Kernel-3.10

Description The issue is related to a debugger in the Linux kernel's FIQ, which has inadequate access control. This could allow a remote attacker to elevate privileges and execute arbitrary code within the kernel context using a local malicious application. The problem is considered serious due to the potential for local permanent device compromise, which might necessitate reflashing the operating system to repair the device.

Recommendations For Linux Kernel versions prior to 3.10: Update to a version that includes the necessary security patches to fix the access control issues in the kernel's FIQ debugger. For Android Kernel-3.10: Consider applying security patches or updates provided by the device manufacturer to address the elevation of privilege vulnerability in the kernel FIQ debugger.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-01511

CVE-2017-0648

Produtos afetados

Android Kernel

Linux Kernel

Referências · 6

• http://securitytracker.com/id/1038623 · Nota
• https://source.android.com/security/bulletin/2017-06-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0648 · Nota de Segurança
• http://securityfocus.com/bid/98875 · Nota
• https://bdu.fstec.ru/vul/2017-01511 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0648 · Aviso do Fabricante