PT-2017-16398 · Google · Android
Published
2017-01-09
·
Updated
2017-01-11
·
CVE-2017-5217
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software
Description
A zero-permission Android application can crash the system server process on certain Samsung Android devices. The application creates an active install session for an embedded app, which writes an APK file to the /data/app directory. The APK file has a large but valid AndroidManifest.xml file, containing a large string value for a permission-tree name. When the system server tries to parse the APK file, it crashes due to memory constraints, causing a soft reboot. This process repeats as parsing APKs is part of the normal boot process.
Recommendations
For Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0) software, consider disabling the
com.android.server.pm.PackagePrefetcher class as a temporary workaround to prevent the system server crash. Restrict access to the /data/app directory to minimize the risk of exploitation. Avoid installing zero-permission apps that may contain embedded APK files with large AndroidManifest.xml files. At the moment, there is no information about a newer version that contains a fix for this issue.Fix
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Android