PT-2017-19118 · Qualcomm+3 · Qrd Android+3

Published 2017-10-10 · Updated 2017-10-19 · CVE-2017-9697

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android for MSM versions (affected versions not specified) Firefox OS for MSM versions (affected versions not specified) QRD Android versions (affected versions not specified)

Description A race condition exists that can allow access to already freed memory while reading command registration table entries in diag dbgfs read table. This issue affects Android releases from CAF using the Linux kernel.

Recommendations For Android for MSM, consider restricting access to the diag dbgfs read table function until a patch is available. For Firefox OS for MSM, avoid using the diag dbgfs read table function in sensitive operations until the issue is resolved. For QRD Android, as a temporary workaround, consider disabling the diag dbgfs read table function until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2017-9697

Affected Products

Android

Firefox Os

Linux Kernel

Qrd Android

References · 4

• https://osv.dev/vulnerability/CVE-2017-9697 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2017-10-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9697 · Security Note
• http://securityfocus.com/bid/101160 · Note