PT-2017-8447 · Qualcomm+1 · Msm8974Pro+3

Berry Cheng · Publicado 2017-02-01 · Atualizado 2017-03-04 · CVE-2016-4038

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung devices with Android KK(4.4) or L and an APQ8084, MSM8974, or MSM8974pro chipset

Description The issue is related to an array index error in the msm sensor config function. This error can be triggered by local users via the gpio config.gpio name value, potentially leading to unspecified impact.

Recommendations For Samsung devices with Android KK(4.4) or L and an APQ8084, MSM8974, or MSM8974pro chipset, consider restricting access to the msm sensor config function until a patch is available. As a temporary workaround, avoid using the gpio config.gpio name value in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-4038

Produtos afetados

Apq8084

Android

Msm8974

Msm8974Pro

Referências · 5

• http://openwall.com/lists/oss-security/2016/04/18/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4038 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/04/17/2 · Nota
• http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2016 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-4038 · Aviso do Fabricante