PT-2017-2312 · Google+1 · Android+1

Chengjia4574 + 1 · Published 2017-06-14 · Updated 2019-10-03 · CVE-2017-0649

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The issue is related to an elevation of privilege vulnerability in the MediaTek sound driver, which could allow a local malicious application to execute arbitrary code within the context of the kernel. This vulnerability is rated as Moderate because it first requires compromising a privileged process and due to vulnerability-specific details that limit the impact of the issue. The vulnerability is associated with inadequate access control in the MediaTek sound driver, potentially allowing an attacker to elevate their privileges and execute arbitrary code in the kernel context using a local malicious application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-01510

CVE-2017-0649

Affected Products

Android

Mediatek Sound Driver

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-0649 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0649 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01510 · Security Note
• https://source.android.com/security/bulletin/2017-06-01 · Vendor Advisory
• http://securitytracker.com/id/1038623 · Note
• http://securityfocus.com/bid/98866 · Note