PT-2017-1102 · Google · Android Kernel

Published 2017-01-12 · Updated 2017-01-23 · CVE-2016-8440

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android Kernel versions 3.18

Description The issue is related to a possible buffer overflow in the SMMU system call, caused by improper input validation in the ADSP SID2CB system call. This may result in the hypervisor memory being overwritten. The exploitation of this issue could allow a remote attacker to cause damage by overwriting the hypervisor memory due to incorrect input validation.

Recommendations For Android Kernel version 3.18, consider applying proper input validation to the ADSP SID2CB system call to prevent potential buffer overflows. As a temporary workaround, restrict access to the SMMU system call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00195

CVE-2016-8440

Affected Products

Android Kernel

References · 5

• https://source.android.com/security/bulletin/2017-01-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8440 · Security Note
• https://bdu.fstec.ru/vul/2017-00195 · Security Note
• http://securityfocus.com/bid/95227 · Note