PT-2017-2313 · Linux+1 · Linux Kernel+1

Roee Hay + 1 · Published 2017-06-14 · Updated 2019-10-03 · CVE-2017-0648

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 3.10 Android Kernel-3.10

Description The issue is related to a debugger in the Linux kernel's FIQ, which has inadequate access control. This could allow a remote attacker to elevate privileges and execute arbitrary code within the kernel context using a local malicious application. The problem is considered serious due to the potential for local permanent device compromise, which might necessitate reflashing the operating system to repair the device.

Recommendations For Linux Kernel versions prior to 3.10: Update to a version that includes the necessary security patches to fix the access control issues in the kernel's FIQ debugger. For Android Kernel-3.10: Consider applying security patches or updates provided by the device manufacturer to address the elevation of privilege vulnerability in the kernel FIQ debugger.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-01511

CVE-2017-0648

Affected Products

Android Kernel

Linux Kernel

References · 6

• https://source.android.com/security/bulletin/2017-06-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0648 · Security Note
• https://bdu.fstec.ru/vul/2017-01511 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0648 · Vendor Advisory
• http://securitytracker.com/id/1038623 · Note
• http://securityfocus.com/bid/98875 · Note