PT-2017-19115 · Qualcomm+3 · Qrd Android+3

Published 2017-10-10 · Updated 2017-10-19 · CVE-2017-9686

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to a possible double free or use after free in the SPS driver when debugfs logging is used. This affects Android releases from CAF that utilize the Linux kernel.

Recommendations For Android for MSM, consider disabling debugfs logging as a temporary workaround until a patch is available. For Firefox OS for MSM, restrict access to the SPS driver to minimize the risk of exploitation. For QRD Android, avoid using the SPS driver with debugfs logging enabled until the issue is resolved.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2017-9686

Affected Products

Android

Firefox Os

Linux Kernel

Qrd Android

References · 4

• https://osv.dev/vulnerability/CVE-2017-9686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9686 · Security Note
• https://source.android.com/security/bulletin/pixel/2017-10-01 · Vendor Advisory
• http://securityfocus.com/bid/101160 · Note