PT-2015-3331 · Amazon · Amazon Fire Os

Marcograss · Published 2015-09-07 · Updated 2017-04-15 · CVE-2015-7292

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Amazon Fire OS versions prior to 2016-01-15

Description The issue is related to a stack-based buffer overflow in the havok write function. This can be exploited by sending a long string to the /dev/hv device, potentially causing a denial of service or other unspecified impacts.

Recommendations For Amazon Fire OS versions prior to 2016-01-15, update to a version released after 2016-01-15 to resolve the issue. As a temporary workaround, consider restricting access to the /dev/hv device to minimize the risk of exploitation.

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

BDU:2017-02465

CVE-2015-7292

Affected Products

Amazon Fire Os

References · 3

• https://bdu.fstec.ru/vul/2017-02465 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7292 · Security Note
• https://marcograss.github.io/security/android/cve/2016/01/15/cve-2015-7292-amazon-kernel-stack-buffer-overflow.html · Note