PT-2017-1105 · Google · Android

Published 2017-01-12 · Updated 2017-01-18 · CVE-2016-8437

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to the version that includes the fix for the issue, specifically Kernel 3.18

Description The issue is related to improper input validation in Access Control APIs, which may cause the access control API to return incorrect memory range checking results. This could potentially allow a remote attacker to obtain incorrect values from the access control API.

Recommendations For Android Kernel 3.18, apply the fix referenced by Android ID: A-31623057 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-00198

CVE-2016-8437

Affected Products

Android

References · 5

• https://source.android.com/security/bulletin/2017-01-01.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8437 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8437 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00198 · Security Note
• http://securityfocus.com/bid/95227 · Note