PT-2017-8447 · Qualcomm+1 · Msm8974Pro+3

Berry Cheng · Published 2017-02-01 · Updated 2017-03-04 · CVE-2016-4038

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung devices with Android KK(4.4) or L and an APQ8084, MSM8974, or MSM8974pro chipset

Description The issue is related to an array index error in the msm sensor config function. This error can be triggered by local users via the gpio config.gpio name value, potentially leading to unspecified impact.

Recommendations For Samsung devices with Android KK(4.4) or L and an APQ8084, MSM8974, or MSM8974pro chipset, consider restricting access to the msm sensor config function until a patch is available. As a temporary workaround, avoid using the gpio config.gpio name value in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-4038

Affected Products

Apq8084

Android

Msm8974

Msm8974Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-4038 · Security Note
• http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4038 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/04/18/8 · Note
• http://openwall.com/lists/oss-security/2016/04/17/2 · Note