PT-2016-5723 · Qualcomm+1 · Qualcomm Sound Codec+1

Scott Bauer · Published 2016-09-11 · Updated 2017-08-13 · CVE-2016-3893

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to 2016-09-05 on Nexus 6P devices

Description The issue is related to the wcdcal hwdep ioctl shared function in the Qualcomm sound codec, which does not properly copy firmware data. This allows attackers to obtain sensitive information via a crafted application.

Recommendations For Android versions prior to 2016-09-05 on Nexus 6P devices, update the Android version to a newer one released after 2016-09-05 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-3893

Affected Products

Android

Qualcomm Sound Codec

References · 9

• https://cve.org/CVERecord?id=CVE-2016-3893 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3893 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3893 · Vendor Advisory
• http://source.android.com/security/bulletin/2016-09-01.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3893 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3893 · Vendor Advisory
• https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=a7a6ddc91cce7ad5ad55c9709b24bfc80f5ac873 · Patch
• http://securitytracker.com/id/1036763 · Note
• http://securityfocus.com/bid/92884 · Note