PT-2017-2117 · Qualcomm+2 · Qualcomm Secure Execution Environment+2

Published 2017-05-16 · Updated 2017-07-11 · CVE-2016-10239

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Secure Execution Environment (affected versions not specified) Android (all releases from CAF using the Linux kernel)

Description The issue is caused by an integer overflow, leading to a buffer overflow in memory. This could allow a remote attacker to bypass existing access control policies. The vulnerability may be exploited due to improper input validation.

Recommendations For Qualcomm Secure Execution Environment, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Android, consider applying configuration changes to restrict access to sensitive areas of the system until a patch is available. Restrict input to prevent improper validation that could lead to integer overflow and subsequent buffer overflow.

Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-119

CWE-680

CWE-190

Related Identifiers

BDU:2017-01294

CVE-2016-10239

Affected Products

Android

Linux Kernel

Qualcomm Secure Execution Environment

References · 5

• https://source.android.com/security/bulletin/2017-04-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01294 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10239 · Security Note
• http://securitytracker.com/id/1038201 · Note
• http://securityfocus.com/bid/97334 · Note