PT-2017-6117 · Google · Android

Published 2017-07-07 · Updated 2018-10-09 · CVE-2014-7953

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android version 4.4.4

Description: A race condition exists in the bindBackupAgent method within the ActivityManagerService in Android. This issue allows local users with adb shell access to execute arbitrary code or install any valid package as the system user. The exploitation involves running pm install with a target APK while simultaneously executing a crafted script that processes logcat output to find a dexopt line. Once the dexopt line is found, the script executes bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.

Recommendations: For Android version 4.4.4, as a temporary workaround, consider restricting access to the bindBackupAgent method until a patch is available. Additionally, restrict the use of adb shell to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2014-7953

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-7953 · Security Note
• http://securityfocus.com/bid/74213 · Note
• https://android.googlesource.com/platform/frameworks/base/+/a8f6d1b%5E%21 · Note
• http://seclists.org/fulldisclosure/2015/Apr/52 · Note
• http://securityfocus.com/archive/1/535296/100/1100/threaded · Note