PT-2016-2382 · Google · Android

Published 2016-07-11 · Updated 2016-11-28 · CVE-2014-9795

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-07-05

Description The issue is caused by an integer overflow in the app/aboot/aboot.c component of Qualcomm in Android, which allows attackers to bypass intended access restrictions. This can be achieved by using crafted start and size values. The exploitation of this issue may allow a remote attacker to bypass existing access restrictions using specially formed variable values.

Recommendations For Android versions prior to 2016-07-05, consider restricting access to the app/aboot/aboot.c component until a patch is available. As a temporary workaround, avoid using crafted start and size values that could trigger the integer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2016-01773

CVE-2014-9795

Affected Products

Android

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2014-9795 · Security Note
• http://source.android.com/security/bulletin/2016-07-01.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9795 · Security Note
• https://bdu.fstec.ru/vul/2016-01773 · Security Note
• https://ubuntu.com/security/CVE-2014-9795 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9795 · Vendor Advisory
• https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=ce2a0ea1f14298abc83729f3a095adab43342342 · Note
• http://securityfocus.com/bid/91628 · Note
• https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=fc3b31f81a1c128c2bcc745564a075022cd72a2e · Note