2754 lines
89 KiB
HTML
2754 lines
89 KiB
HTML
<html devsite>
|
|
<head>
|
|
<title>Android Security Bulletin—March 2017</title>
|
|
<meta name="project_path" value="/_project.yaml" />
|
|
<meta name="book_path" value="/_book.yaml" />
|
|
</head>
|
|
<body>
|
|
<!--
|
|
Copyright 2017 The Android Open Source Project
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
-->
|
|
|
|
|
|
<p><em>Published March 06, 2017 | Updated March 07, 2017</em></p>
|
|
<p>The Android Security Bulletin contains details of security vulnerabilities
|
|
affecting Android devices. Alongside the bulletin, we have released a security
|
|
update to Google devices through an over-the-air (OTA) update. The Google device
|
|
firmware images have also been released to the <a
|
|
href="https://developers.google.com/android/nexus/images">Google Developer
|
|
site</a>. Security patch levels of March 05, 2017 or later address all of these
|
|
issues. Refer to the <a
|
|
href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel
|
|
and Nexus update schedule</a> to learn how to check a device's security patch
|
|
level.</p>
|
|
<p>Partners were notified of the issues described in the bulletin on February 06,
|
|
2017 or earlier. Source code patches for these issues have been released to the
|
|
Android Open Source Project (AOSP) repository and linked from this bulletin.
|
|
This bulletin also includes links to patches outside of AOSP.</p>
|
|
<p>The most severe of these issues is a Critical security vulnerability that could
|
|
enable remote code execution on an affected device through multiple methods such
|
|
as email, web browsing, and MMS when processing media files. The
|
|
<a href="/security/overview/updates-resources.html#severity">severity
|
|
assessment</a> is based on the effect that exploiting the vulnerability would
|
|
possibly have on an affected device, assuming the platform and service
|
|
mitigations are disabled for development purposes or if successfully bypassed.</p>
|
|
<p>We have had no reports of active customer exploitation or abuse of these newly
|
|
reported issues. Refer to the <a
|
|
href="#mitigations">Android and Google service
|
|
mitigations</a> section for details on the <a
|
|
href="/security/enhancements/index.html">Android
|
|
security platform protections</a> and service protections such as <a
|
|
href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>,
|
|
which improve the security of the Android platform.</p>
|
|
<p>We encourage all customers to accept these updates to their devices.</p>
|
|
<h2 id="announcements">Announcements</h2>
|
|
<ul>
|
|
<li>This bulletin has two security patch level strings to provide Android
|
|
partners with the flexibility to more quickly fix a subset of vulnerabilities
|
|
that are similar across all Android devices. See <a
|
|
href="#common-questions-and-answers">Common questions and answers</a> for
|
|
additional information:
|
|
<ul>
|
|
<li><strong>2017-03-01</strong>: Partial security patch level string. This
|
|
security patch level string indicates that all issues associated with 2017-03-01
|
|
(and all previous security patch level strings) are addressed.</li>
|
|
<li><strong>2017-03-05</strong>: Complete security patch level string. This
|
|
security patch level string indicates that all issues associated with 2017-03-01
|
|
and 2017-03-05 (and all previous security patch level strings) are addressed.</li>
|
|
</ul>
|
|
</li>
|
|
<li>Supported Google devices will receive a single OTA update with the March
|
|
05, 2017 security patch level.</li>
|
|
</ul>
|
|
<h2 id="mitigations">Android and Google service
|
|
mitigations</h2>
|
|
<p>This is a summary of the mitigations provided by the <a
|
|
href="/security/enhancements/index.html">Android
|
|
security platform</a> and service protections, such as SafetyNet. These
|
|
capabilities reduce the likelihood that security vulnerabilities could be
|
|
successfully exploited on Android.</p>
|
|
<ul>
|
|
<li>Exploitation for many issues on Android is made more difficult by
|
|
enhancements in newer versions of the Android platform. We encourage all users
|
|
to update to the latest version of Android where possible.</li>
|
|
<li>The Android Security team actively monitors for abuse with <a
|
|
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
|
|
Apps and SafetyNet</a>, which are designed to warn users about <a
|
|
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
|
|
Harmful Applications</a>. Verify Apps is enabled by default on devices with <a
|
|
href="http://www.android.com/gms">Google Mobile Services</a> and is especially
|
|
important for users who install applications from outside of Google Play. Device
|
|
rooting tools are prohibited within Google Play, but Verify Apps warns users
|
|
when they attempt to install a detected rooting application—no matter where it
|
|
comes from. Additionally, Verify Apps attempts to identify and block
|
|
installation of known malicious applications that exploit a privilege escalation
|
|
vulnerability. If such an application has already been installed, Verify Apps
|
|
will notify the user and attempt to remove the detected application.</li>
|
|
<li>As appropriate, Google Hangouts and Messenger applications do not
|
|
automatically pass media to processes such as Mediaserver.</li>
|
|
</ul>
|
|
<h2 id="acknowledgements">Acknowledgements</h2>
|
|
<p>We would like to thank these researchers for their contributions:</p>
|
|
<ul>
|
|
<li>Alexander Potapenko of Google Dynamic Tools team: CVE-2017-0537
|
|
<li>Baozeng Ding, Chengming Yang, Peng Xiao, and Yang Song of Alibaba Mobile
|
|
Security Group: CVE-2017-0506
|
|
<li>Baozeng Ding, Ning You, Chengming Yang, Peng Xiao, and Yang Song of Alibaba
|
|
Mobile Security Group: CVE-2017-0463
|
|
<li>Billy Lau of Android Security: CVE-2017-0335, CVE-2017-0336, CVE-2017-0338,
|
|
CVE-2017-0460
|
|
<li><a href="mailto:derrek.haxx@gmail.com">derrek</a> (<a
|
|
href="https://twitter.com/derrekr6">@derrekr6</a>): CVE-2016-8413,
|
|
CVE-2016-8477, CVE-2017-0531
|
|
<li><a href="mailto:derrek.haxx@gmail.com">derrek</a> (<a
|
|
href="https://twitter.com/derrekr6">@derrekr6</a>) and <a
|
|
href="mailto:sbauer@plzdonthack.me">Scott Bauer</a> (<a
|
|
href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>): CVE-2017-0521
|
|
<li>Di Shen (<a href="https://twitter.com/returnsme">@returnsme</a>) of KeenLab
|
|
(<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2017-0334,
|
|
CVE-2017-0456, CVE-2017-0457, CVE-2017-0525
|
|
<li>En He (<a href="https://twitter.com/heeeeen4x">@heeeeen4x</a>) and Bo Liu of
|
|
<a href="http://www.ms509.com">MS509Team</a>: CVE-2017-0490
|
|
<li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>)
|
|
and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360
|
|
Technology Co. Ltd.: CVE-2017-0500, CVE-2017-0501, CVE-2017-0502, CVE-2017-0503,
|
|
CVE-2017-0509, CVE-2017-0524, CVE-2017-0529, CVE-2017-0536
|
|
<li>Hao Chen and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd.:
|
|
CVE-2017-0453, CVE-2017-0461, CVE-2017-0464
|
|
<li>Hiroki Yamamoto and Fang Chen of Sony Mobile Communications Inc.:
|
|
CVE-2017-0481
|
|
<li>IBM Security X-Force Researchers Sagi Kedmi and Roee Hay: CVE-2017-0510
|
|
<li>Jianjun Dai (<a href="https://twitter.com/Jioun_dai">@Jioun_dai</a>) of <a
|
|
href="https://skyeye.360safe.com">Qihoo 360 Skyeye Labs</a>: CVE-2017-0478
|
|
<li>Jianqiang Zhao (<a
|
|
href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and <a
|
|
href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360: CVE-2016-8416,
|
|
CVE-2016-8478, CVE-2017-0458, CVE-2017-0459, CVE-2017-0518, CVE-2017-0519,
|
|
CVE-2017-0533, CVE-2017-0534
|
|
<li><a href="mailto:zlbzlb815@163.com">Lubo Zhang</a>, <a
|
|
href="mailto:segfault5514@gmail.com">Tong Lin</a>, <a
|
|
href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, and Xuxian Jiang of <a
|
|
href="http://c0reteam.org">C0RE Team</a>: CVE-2016-8479
|
|
<li>Makoto Onuki of Google: CVE-2017-0491
|
|
<li>Mingjian Zhou (<a
|
|
href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), <a
|
|
href="mailto:arnow117@gmail.com">Hanxiang Wen</a>, and Xuxian Jiang of <a
|
|
href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0479, CVE-2017-0480
|
|
<li>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>):
|
|
CVE-2017-0535
|
|
<li>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>) of
|
|
Tesla Motors Product Security Team: CVE-2017-0306
|
|
<li>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), Lenx Wei (韦韬) of Baidu X-Lab
|
|
(百度安全实验室): CVE-2016-8417
|
|
<li>Qidan He (何淇丹) (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>)
|
|
of KeenLab, Tencent: CVE-2017-0337, CVE-2017-0476
|
|
<li>Qing Zhang of Qihoo 360 and Guangdong Bai of Singapore Institute of
|
|
Technology (SIT): CVE-2017-0496
|
|
<li>Quhe and wanchouchou of Ant-financial Light-Year Security Lab
|
|
(蚂蚁金服巴斯光年安全实验室): CVE-2017-0522
|
|
<li><a href="mailto:keun-o.park@darkmatter.ae">Sahara</a> of Secure
|
|
Communications in DarkMatter: CVE-2017-0528
|
|
<li>salls (<a href="https://twitter.com/chris_salls">@chris_salls</a>) of
|
|
Shellphish Grill Team, UC Santa Barbara: CVE-2017-0505
|
|
<li><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a> (<a
|
|
href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>): CVE-2017-0504,
|
|
CVE-2017-0516
|
|
<li>Sean Beaupre (beaups): CVE-2017-0455
|
|
<li>Seven Shen (<a href="https://twitter.com/lingtongshen">@lingtongshen</a>) of
|
|
Trend Micro: CVE-2017-0452
|
|
<li>Shinichi Matsumoto of Fujitsu: CVE-2017-0498
|
|
<li><a href="mailto:smarques84@gmail.com">Stéphane Marques</a> of <a
|
|
href="http://www.byterev.com">ByteRev</a>: CVE-2017-0489
|
|
<li>Svetoslav Ganov of Google: CVE-2017-0492
|
|
<li><a href="mailto:segfault5514@gmail.com">Tong Lin</a>, <a
|
|
href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, and Xuxian Jiang of <a
|
|
href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0333
|
|
<li>V.E.O (<a href="https://twitter.com/vysea">@VYSEa</a>) of <a
|
|
href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile">Mobile
|
|
Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro</a>:
|
|
CVE-2017-0466, CVE-2017-0467, CVE-2017-0468, CVE-2017-0469, CVE-2017-0470,
|
|
CVE-2017-0471, CVE-2017-0472, CVE-2017-0473, CVE-2017-0482, CVE-2017-0484,
|
|
CVE-2017-0485, CVE-2017-0486, CVE-2017-0487, CVE-2017-0494, CVE-2017-0495
|
|
<li>Wish Wu (吴潍浠 此彼) (<a href="https://twitter.com/wish_wu">@wish_wu</a>) of
|
|
Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室): CVE-2017-0477
|
|
<li>Yu Pan of Vulpecker Team, Qihoo 360 Technology Co. Ltd: CVE-2017-0517,
|
|
CVE-2017-0532
|
|
<li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, and Xuxian Jiang
|
|
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0526, CVE-2017-0527
|
|
<li>Yuqi Lu (<a href="https://twitter.com/nikos233__">@nikos233</a>), <a
|
|
href="mailto:vancouverdou@gmail.com">Wenke Dou</a>, <a
|
|
href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a>, Mingjian Zhou (<a
|
|
href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), and Xuxian Jiang
|
|
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0483</li>
|
|
<li>Zinuo Han (<a href="https://weibo.com/ele7enxxh">weibo.com/ele7enxxh</a>)
|
|
of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd.:
|
|
CVE-2017-0475, CVE-2017-0497
|
|
</ul>
|
|
|
|
<h2 id="2017-03-01-details">2017-03-01 security patch level—Vulnerability
|
|
details</h2>
|
|
<p>In the sections below, we provide details for each of the security
|
|
vulnerabilities that apply to the 2017-03-01 patch level. There is a description
|
|
of the issue, a severity rationale, and a table with the CVE, associated
|
|
references, severity, updated Google devices, updated AOSP versions (where
|
|
applicable), and date reported. When available, we will link the public change
|
|
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
|
changes relate to a single bug, additional references are linked to numbers
|
|
following the bug ID.</p>
|
|
|
|
|
|
<h3 id="rce-in-openssl-&-boringssl">Remote code execution vulnerability in
|
|
OpenSSL & BoringSSL</h3>
|
|
<p>A remote code execution vulnerability in OpenSSL and BoringSSL could enable an
|
|
attacker using a specially crafted file to cause memory corruption during file
|
|
and data processing. This issue is rated as Critical due to the possibility of
|
|
remote code execution within the context of a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-2182</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/boringssl/+/54bf62a81586d99d0a951ca3342d569b59e69b80">
|
|
A-32096880</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Aug 5, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-mediaserver-">Remote code execution vulnerability in Mediaserver
|
|
</h3>
|
|
<p>A remote code execution vulnerability in Mediaserver could enable an attacker
|
|
using a specially crafted file to cause memory corruption during media file and
|
|
data processing. This issue is rated as Critical due to the possibility of
|
|
remote code execution within the context of the Mediaserver process.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0466</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/c4f152575bd6d8cc6db1f89806e2ba1fd1bb314f">A-33139050</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/ec9ab83ac437d31f484a86643e2cc66db8efae4c">2</a>]
|
|
</td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0467</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/c4f152575bd6d8cc6db1f89806e2ba1fd1bb314f">A-33250932</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/fd9a12f9fdd9dd3e66c59dd7037e864b948085f7">2</a>]
|
|
</td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 30, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0468</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/0e8b1dff88e08b9d738d2360f05b96108e190995">A-33351708</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/fd9a12f9fdd9dd3e66c59dd7037e864b948085f7">2</a>]
|
|
</td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 5, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0469</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/21851eaecc814be709cb0c20f732cb858cfe1440">
|
|
A-33450635</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 8, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0470</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/6aac82003d665708b4e21e9b91693b642e2fa64f">
|
|
A-33818500</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 21, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0471</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/4a61d15e7b0ab979ba7e80db8ddbde025c1ce6cc">
|
|
A-33816782</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 21, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0472</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libhevc/+/dfa7251ff270ae7e12a019e6735542e36b2a47e0">
|
|
A-33862021</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 23, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0473</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/0a4463e2beddb8290e05ad552e48b17686f854ce">
|
|
A-33982658</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 30, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0474</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libvpx/+/6f5927de29337fa532c64d0ef8c7cb68f7c89889">
|
|
A-32589224</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="eop-in-recovery-verifier">Elevation of privilege vulnerability in
|
|
recovery verifier</h3>
|
|
<p>An elevation of privilege vulnerability in the recovery verifier could enable a
|
|
local malicious application to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0475</td>
|
|
<td><a href="https://android.googlesource.com/platform/bootable/recovery/+/2c6c23f651abb3d215134dfba463eb72a5e9f8eb">
|
|
A-31914369</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 2, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-aosp-messaging">Remote code execution vulnerability in AOSP
|
|
Messaging</h3>
|
|
<p>A remote code execution vulnerability in AOSP Messaging could enable an
|
|
attacker using a specially crafted file to cause memory corruption during media
|
|
file and data processing. This issue is rated as High due to the possibility of
|
|
remote code execution within the context of an unprivileged process.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0476</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Messaging/+/8ba22b48ebff50311d7eaa8d512f9d507f0bdd0d">
|
|
A-33388925</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 6, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-libgdx">Remote code execution vulnerability in libgdx</h3>
|
|
<p>A remote code execution vulnerability in libgdx could enable an attacker using
|
|
a specially crafted file to execute arbitrary code within the context of an
|
|
unprivileged process. This issue is rated as High due to the possibility of
|
|
remote code execution in an application that uses this library.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0477</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libgdx/+/fba04a52f43315cdb7dd38766822af0324eab7c5">
|
|
A-33621647</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>7.1.1</td>
|
|
<td>Dec 14, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-framesequence-library">Remote code execution vulnerability in
|
|
Framesequence library</h3>
|
|
<p>A remote code execution vulnerability in the Framesequence library could enable
|
|
an attacker using a specially crafted file to execute arbitrary code in the
|
|
context of an unprivileged process. This issue is rated as High due to the
|
|
possibility of remote code execution in an application that uses the
|
|
Framesequence library.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0478</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/ex/+/7c824f17b3eea976ca58be7ea097cb807126f73b">
|
|
A-33718716</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 16, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="eop-in-nfc">Elevation of privilege vulnerability in NFC</h3>
|
|
<p>An elevation of privilege vulnerability in NFC could enable a proximate
|
|
attacker to execute arbitrary code within the context of a privileged process.
|
|
This issue is rated as High because it could be used to gain local access to
|
|
elevated capabilities, which are not normally accessible to a third-party
|
|
application.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0481</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libnfc-nci/+/c67cc6ad2addddcb7185a33b08d27290ce54e350">
|
|
A-33434992</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 6, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="eop-in-audioserver">Elevation of privilege vulnerability in
|
|
Audioserver</h3>
|
|
<p>An elevation of privilege vulnerability in Audioserver could enable a local
|
|
malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as High because it could be used to
|
|
gain local access to elevated capabilities, which are not normally accessible
|
|
to a third-party application.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0479</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/22e26d8ee73488c58ba3e7928e5da155151abfd0">
|
|
A-32707507</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/av/+/8415635765380be496da9b4578d8f134a527d86b">2</a>]
|
|
</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0480</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/22e26d8ee73488c58ba3e7928e5da155151abfd0">
|
|
A-32705429</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/av/+/8415635765380be496da9b4578d8f134a527d86b">2</a>]
|
|
</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="dos-in-mediaserver">Denial of service vulnerability in Mediaserver</h3>
|
|
<p>A denial of service vulnerability in Mediaserver could enable an attacker to
|
|
use a specially crafted file to cause a device hang or reboot. This issue is
|
|
rated as High severity due to the possibility of remote denial of service.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0482</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/ec9ab83ac437d31f484a86643e2cc66db8efae4c">
|
|
A-33090864</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/0e8b1dff88e08b9d738d2360f05b96108e190995">2</a>]
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/a467b1fb2956fdcee5636ab63573a4bca8150dbe">3</a>]
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/3695b6bdaa183bb2852da06b63ebd5b9c2cace36">4</a>]
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/c4f152575bd6d8cc6db1f89806e2ba1fd1bb314f">5</a>]
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/fd9a12f9fdd9dd3e66c59dd7037e864b948085f7">6</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 22, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0483</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/bc62c086e9ba7530723dc8874b83159f4d77d976">
|
|
A-33137046</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/av/+/5cabe32a59f9be1e913b6a07a23d4cfa55e3fb2f">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 24, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0484</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/fd9a12f9fdd9dd3e66c59dd7037e864b948085f7">
|
|
A-33298089</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libavc/+/a467b1fb2956fdcee5636ab63573a4bca8150dbe">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 1, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0485</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/3695b6bdaa183bb2852da06b63ebd5b9c2cace36">
|
|
A-33387820</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 6, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0486</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/19814b7ad4ea6f0cc4cab34e50ebab2e180fc269">
|
|
A-33621215</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 14, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0487</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/aa78b96e842fc1fb70a18acff22be35c7a715b23">
|
|
A-33751193</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 19, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0488</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/0340381cd8c220311fd4fe2e8b23e1534657e399">
|
|
A-34097213</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="eop-in-location-manager">Elevation of privilege vulnerability in
|
|
Location Manager</h3>
|
|
<p>An elevation of privilege vulnerability in Location Manager could enable a
|
|
local malicious application to bypass operating system protections for location
|
|
data. This issue is rated as Moderate because it could be used to generate
|
|
inaccurate data.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0489</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/d22261fef84481651e12995062105239d551cbc6">
|
|
A-33091107</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 20, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-wi-fi">Elevation of privilege vulnerability in Wi-Fi</h3>
|
|
<p>An elevation of privilege vulnerability in Wi-Fi could enable a local malicious
|
|
application to delete user data. This issue is rated as Moderate because it is
|
|
a local bypass of user interaction requirements that would normally require
|
|
either user initiation or user permission. </p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0490</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/CertInstaller/+/1166ca8adba9b49c9185dad11b28b02e72124d95">
|
|
A-33178389</a>
|
|
[<a href="https://android.googlesource.com/platform/packages/apps/CertInstaller/+/1ad3b1e3256a226be362de1a4959f2a642d349b7">2</a>]
|
|
[<a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/41c42f5bb544acf8bede2d05c6325657d92bd83c">3</a>]
|
|
</td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 25, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-package-manager">Elevation of privilege vulnerability in Package
|
|
Manager</h3>
|
|
<p>An elevation of privilege vulnerability in Package Manager could enable a local
|
|
malicious application to prevent users from uninstalling applications or
|
|
removing permissions from applications. This issue is rated as Moderate because
|
|
it is a local bypass of user interaction requirements.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0491</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/PackageInstaller/+/5c49b6bf732c88481466dea341917b8604ce53fa">
|
|
A-32553261</a>
|
|
</td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-system-ui">Elevation of privilege vulnerability in System
|
|
UI</h3>
|
|
<p>An elevation of privilege vulnerability in the System UI could enable a local
|
|
malicious application to create a UI overlay covering the entire screen. This
|
|
issue is rated as Moderate because it is a local bypass of user interaction
|
|
requirements that would normally require either user initiation or user
|
|
permission.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0492</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/f4bed684c939b0f8809ef404b8609fe4ef849263">
|
|
A-30150688</a>
|
|
</td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-aosp-messaging">Information disclosure vulnerability in AOSP
|
|
Messaging</h3>
|
|
<p>An information disclosure vulnerability in AOSP Messaging could enable a remote
|
|
attacker using a special crafted file to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it could be used to access
|
|
sensitive data without permission.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0494</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Messaging/+/3f9821128abd66c4cd2f040d8243efb334bfad2d">
|
|
A-32764144</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 9, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-mediaserver">Information disclosure vulnerability in
|
|
Mediaserver</h3>
|
|
<p>An information disclosure vulnerability in Mediaserver could enable a local
|
|
malicious application to access data outside of its permission levels. This
|
|
issue is rated as Moderate because it could be used to access sensitive data
|
|
without permission.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0495</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/85c0ec4106659a11c220cd1210f8d76c33d9e2ae">
|
|
A-33552073</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Dec 11, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="dos-in-setup-wizard">Denial of service vulnerability in Setup
|
|
Wizard</h3>
|
|
<p>A denial of service vulnerability in Setup Wizard could allow a local malicious
|
|
application to temporarily block access to an affected device. This issue is
|
|
rated as Moderate because it may require a factory reset to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0496</td>
|
|
<td>A-31554152*</td>
|
|
<td>Moderate</td>
|
|
<td>None**</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
|
<td>Sep 14, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained in
|
|
the latest binary drivers for Google devices available from the <a
|
|
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
|
site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
<h3 id="dos-in-mediaserver-2">Denial of service vulnerability in
|
|
Mediaserver</h3>
|
|
<p>A denial of service vulnerability in Mediaserver could enable an attacker to
|
|
use a specially crafted file to cause a device hang or reboot. This issue is
|
|
rated as Moderate because it requires an uncommon device configuration.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0497</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/skia/+/8888cbf8e74671d44e9ff92ec3847cd647b8cdfb">
|
|
A-33300701</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Dec 2, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="dos-in-setup-wizard-2">Denial of service vulnerability in Setup
|
|
Wizard</h3>
|
|
<p>A denial of service vulnerability in Setup Wizard could allow a local attacker
|
|
to require Google account sign-in after a factory reset. This issue is rated as
|
|
Moderate because it may require a factory reset to repair the device. </p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0498</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/1c4d535d0806dbeb6d2fa5cea0373cbd9ab6d33b">
|
|
A-30352311</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/base/+/5f621b5b1549e8379aee05807652d5111382ccc6">2</a>]
|
|
</td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="dos-in-audioserver">Denial of service vulnerability in Audioserver</h3>
|
|
<p>A denial of service vulnerability in Audioserver could enable a local malicious
|
|
application to cause a device hang or reboot. This issue is rated as Low due to
|
|
the possibility of a temporary denial of service.</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0499</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/22e26d8ee73488c58ba3e7928e5da155151abfd0">
|
|
A-32095713</a></td>
|
|
<td>Low</td>
|
|
<td>All</td>
|
|
<td>5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 11, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h2 id="2017-03-05-details">2017-03-05 security patch level—Vulnerability
|
|
details</h2>
|
|
<p>In the sections below, we provide details for each of the security
|
|
vulnerabilities that apply to the 2017-03-05 patch level. There is a description
|
|
of the issue, a severity rationale, and a table with the CVE, associated
|
|
references, severity, updated Google devices, updated AOSP versions (where
|
|
applicable), and date reported. When available, we will link the public change
|
|
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
|
changes relate to a single bug, additional references are linked to numbers
|
|
following the bug ID.</p>
|
|
|
|
|
|
<h3 id="eop-in-mediatek-components">Elevation of privilege vulnerability in
|
|
MediaTek components</h3>
|
|
<p>An elevation of privilege vulnerability in MediaTek components, including the
|
|
M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue
|
|
driver, could enable a local malicious application to execute arbitrary code
|
|
within the context of the kernel. This issue is rated as Critical due to the
|
|
possibility of a local permanent device compromise, which may require
|
|
reflashing the operating system to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0500</td>
|
|
<td>A-28429685*<br>
|
|
M-ALPS02710006</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Apr 27, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0501</td>
|
|
<td>A-28430015*<br>
|
|
M-ALPS02708983</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Apr 27, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0502</td>
|
|
<td>A-28430164*<br>
|
|
M-ALPS02710027</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Apr 27, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0503</td>
|
|
<td>A-28449045*<br>
|
|
M-ALPS02710075</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Apr 28, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0504</td>
|
|
<td>A-30074628*<br>
|
|
M-ALPS02829371</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Jul 9, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0505</td>
|
|
<td>A-31822282*<br>
|
|
M-ALPS02992041</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Sep 28, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0506</td>
|
|
<td>A-32276718*<br>
|
|
M-ALPS03006904</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Oct 18, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-nvidia-gpu-driver">Elevation of privilege vulnerability in
|
|
NVIDIA GPU driver</h3>
|
|
<p>An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a
|
|
local malicious application to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0337</td>
|
|
<td>A-31992762*<br>
|
|
N-CVE-2017-0337</td>
|
|
<td>Critical</td>
|
|
<td>Pixel C</td>
|
|
<td>Oct 6, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0338</td>
|
|
<td>A-33057977*<br>
|
|
N-CVE-2017-0338</td>
|
|
<td>Critical</td>
|
|
<td>Pixel C</td>
|
|
<td>Nov 21, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0333</td>
|
|
<td>A-33899363*<br>
|
|
N-CVE-2017-0333</td>
|
|
<td>Critical</td>
|
|
<td>Pixel C</td>
|
|
<td>Dec 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0306</td>
|
|
<td>A-34132950*<br>
|
|
N-CVE-2017-0306</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 9</td>
|
|
<td>Jan 6, 2017</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0335</td>
|
|
<td>A-33043375*<br>
|
|
N-CVE-2017-0335</td>
|
|
<td>Critical</td>
|
|
<td>Pixel C</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-ion-subsystem">Elevation of privilege vulnerability in
|
|
kernel ION subsystem</h3>
|
|
<p>An elevation of privilege vulnerability in the kernel ION subsystem could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Critical due to the possibility
|
|
of a local permanent device compromise, which may require reflashing the
|
|
operating system to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0507</td>
|
|
<td>A-31992382*</td>
|
|
<td>Critical</td>
|
|
<td>Android One, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel
|
|
C, Pixel, Pixel XL</td>
|
|
<td>Oct 6, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0508</td>
|
|
<td>A-33940449*</td>
|
|
<td>Critical</td>
|
|
<td>Pixel C</td>
|
|
<td>Dec 28, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-broadcom-wi-fi-driver">Elevation of privilege vulnerability in
|
|
Broadcom Wi-Fi driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Critical due to the possibility
|
|
of a local permanent device compromise, which may require reflashing the
|
|
operating system to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0509</td>
|
|
<td>A-32124445*<br>
|
|
B-RB#110688</td>
|
|
<td>Critical</td>
|
|
<td>None**</td>
|
|
<td>Oct 12, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-fiq-debugger">Elevation of privilege vulnerability in
|
|
kernel FIQ debugger</h3>
|
|
<p>An elevation of privilege vulnerability in the kernel FIQ debugger could enable
|
|
a local malicious application to execute arbitrary code within the context of
|
|
the kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0510</td>
|
|
<td>A-32402555*</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 9</td>
|
|
<td>Oct 25, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-gpu-driver">Elevation of privilege vulnerability in
|
|
Qualcomm GPU driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm GPU driver could enable
|
|
a local malicious application to execute arbitrary code within the context of
|
|
the kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8479</td>
|
|
<td>A-31824853*<br>
|
|
QC-CR#1093687</td>
|
|
<td>Critical</td>
|
|
<td>Android One, Nexus 5X, Nexus 6, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Sep 29, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-networking-subsystem">Elevation of privilege
|
|
vulnerability in kernel networking subsystem</h3>
|
|
<p>An elevation of privilege vulnerability in the kernel networking subsystem
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Critical due to the possibility
|
|
of a local permanent device compromise, which may require reflashing the
|
|
operating system to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-9806</td>
|
|
<td>A-33393474<br>
|
|
<a
|
|
href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92964c79b357efd980812c4de5c1fd2ec8bb5520">
|
|
Upstream kernel</a></td>
|
|
<td>Critical</td>
|
|
<td>Pixel C, Pixel, Pixel XL</td>
|
|
<td>Dec 4, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-10200</td>
|
|
<td>A-33753815<br>
|
|
<a
|
|
href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=32c231164b762dddefa13af5a0101032c70b50ef">
|
|
Upstream kernel</a></td>
|
|
<td>Critical</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Dec 19, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm
|
|
components</h3>
|
|
<p>The following vulnerability affects Qualcomm components and is described in
|
|
further detail in Qualcomm AMSS September 2016 security bulletin.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8484</td>
|
|
<td>A-28823575**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8485</td>
|
|
<td>A-28823681**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8486</td>
|
|
<td>A-28823691**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8487</td>
|
|
<td>A-28823724**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8488</td>
|
|
<td>A-31625756**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The severity rating for these vulnerabilities was determined by the vendor.</p>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>*** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-networking-subsystem-2">Elevation of privilege
|
|
vulnerability in kernel networking subsystem</h3>
|
|
<p>An elevation of privilege vulnerability in the kernel networking subsystem
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8655</td>
|
|
<td>A-33358926<br>
|
|
<a
|
|
href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c">
|
|
Upstream kernel</a></td>
|
|
<td>High</td>
|
|
<td>Android One, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel
|
|
C, Pixel, Pixel XL</td>
|
|
<td>Oct 12, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-9793</td>
|
|
<td>A-33363517<br>
|
|
<a
|
|
href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b98b0bc8c431e3ceb4b26b0dfc8db509518fb290">
|
|
Upstream kernel</a></td>
|
|
<td>High</td>
|
|
<td>Android One, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel
|
|
C, Pixel, Pixel XL</td>
|
|
<td>Dec 2, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-input-hardware-driver">Elevation of privilege
|
|
vulnerability in Qualcomm input hardware driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm input hardware driver
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0516</td>
|
|
<td>A-32341680*<br>
|
|
QC-CR#1096301</td>
|
|
<td>High</td>
|
|
<td>Android One, Pixel, Pixel XL</td>
|
|
<td>Oct 21, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-mediatek-hardware-sensor-driver">Elevation of privilege
|
|
vulnerability in MediaTek Hardware Sensor Driver</h3>
|
|
<p>An elevation of privilege vulnerability in the MediaTek hardware sensor driver
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0517</td>
|
|
<td>A-32372051*<br>
|
|
M-ALPS02973195</td>
|
|
<td>High</td>
|
|
<td>None**</td>
|
|
<td>Oct 22, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-adsprpc-driver">Elevation of privilege vulnerability in
|
|
Qualcomm ADSPRPC driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0457</td>
|
|
<td>A-31695439*<br>
|
|
QC-CR#1086123<br>
|
|
QC-CR#1100695</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Sep 22, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-fingerprint-sensor-driver">Elevation of privilege
|
|
vulnerability in Qualcomm fingerprint sensor driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm fingerprint sensor
|
|
driver could enable a local malicious application to execute arbitrary code
|
|
within the context of the kernel. This issue is rated as High because it first
|
|
requires compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0518</td>
|
|
<td>A-32370896*<br>
|
|
QC-CR#1086530</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 24, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0519</td>
|
|
<td>A-32372915*<br>
|
|
QC-CR#1086530</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 24, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-crypto-engine-driver">Elevation of privilege
|
|
vulnerability in Qualcomm crypto engine driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm crypto engine driver
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0520</td>
|
|
<td>A-31750232<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=eb2aad752c43f57e88ab9b0c3c5ee7b976ee31dd">
|
|
QC-CR#1082636</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Sep 24, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-camera-driver">Elevation of privilege vulnerability in
|
|
Qualcomm camera driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm camera driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0458</td>
|
|
<td>A-32588962<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=eba46cb98431ba1d7a6bd859f26f6ad03f1bf4d4">
|
|
QC-CR#1089433</a></td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 31, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0521</td>
|
|
<td>A-32919951<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=dbe4f26f200db10deaf38676b96d8738afcc10c8">
|
|
QC-CR#1097709</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-mediatek-apk">Elevation of privilege vulnerability in MediaTek
|
|
APK</h3>
|
|
<p>An elevation of privilege vulnerability in a MediaTek APK could enable a local
|
|
malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as High due to the possibility of local
|
|
arbitrary code execution in a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0522</td>
|
|
<td>A-32916158*<br>
|
|
M-ALPS03032516</td>
|
|
<td>High</td>
|
|
<td>None**</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-wi-fi-driver">Elevation of privilege vulnerability in
|
|
Qualcomm Wi-Fi driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0464</td>
|
|
<td>A-32940193<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=051597a4fe19fd1292fb7ea2e627d12d1fd2934f">
|
|
QC-CR#1102593</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0453</td>
|
|
<td>A-33979145<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05af1f34723939f477cb7d25adb320d016d68513">
|
|
QC-CR#1105085</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Android One</td>
|
|
<td>Dec 30, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0523</td>
|
|
<td>A-32835279<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5bb646471da76d3d5cd02cf3da7a03ce6e3cb582">
|
|
QC-CR#1096945</a></td>
|
|
<td>High</td>
|
|
<td>None*</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-synaptics-touchscreen-driver">Elevation of privilege
|
|
vulnerability in Synaptics touchscreen driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Synaptics touchscreen driver
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0524</td>
|
|
<td>A-33002026</td>
|
|
<td>High</td>
|
|
<td>Android One, Nexus 5X, Nexus 6P, Nexus 9, Pixel, Pixel XL</td>
|
|
<td>Nov 18, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-ipa-driver">Elevation of privilege vulnerability in
|
|
Qualcomm IPA driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm IPA driver could enable
|
|
a local malicious application to execute arbitrary code within the context of
|
|
the kernel. This issue is rated as High because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0456</td>
|
|
<td>A-33106520*<br>
|
|
QC-CR#1099598</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 23, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0525</td>
|
|
<td>A-33139056*<br>
|
|
QC-CR#1097714</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 25, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-htc-sensor-hub-driver">Elevation of privilege vulnerability in
|
|
HTC Sensor Hub Driver</h3>
|
|
<p>An elevation of privilege vulnerability in the HTC Sensor Hub Driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0526</td>
|
|
<td>A-33897738*</td>
|
|
<td>High</td>
|
|
<td>Nexus 9</td>
|
|
<td>Dec 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0527</td>
|
|
<td>A-33899318*</td>
|
|
<td>High</td>
|
|
<td>Nexus 9, Pixel, Pixel XL</td>
|
|
<td>Dec 25, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-nvidia-gpu-driver-2">Elevation of privilege vulnerability in
|
|
NVIDIA GPU driver</h3>
|
|
<p>An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a
|
|
local malicious application to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0307</td>
|
|
<td>A-33177895*<br>
|
|
N-CVE-2017-0307</td>
|
|
<td>High</td>
|
|
<td>None**</td>
|
|
<td>Nov 28, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-networking-driver">Elevation of privilege vulnerability
|
|
in Qualcomm networking driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm networking driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0463</td>
|
|
<td>A-33277611<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=955bd7e7ac097bdffbadafab90e5378038fefeb2">
|
|
QC-CR#1101792</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 30, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0460 </td>
|
|
<td>A-31252965*<br>
|
|
QC-CR#1098801</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel, Pixel XL</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-security-subsystem">Elevation of privilege vulnerability
|
|
in kernel security subsystem</h3>
|
|
<p>An elevation of privilege vulnerability in the kernel security subsystem could
|
|
enable a local malicious application to to execute code in the context of a
|
|
privileged process. This issue is rated as High because it is a general bypass
|
|
for a kernel level defense in depth or exploit mitigation technology.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0528</td>
|
|
<td>A-33351919*</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Dec 4, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-spcom-driver">Elevation of privilege vulnerability in
|
|
Qualcomm SPCom driver</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm SPCom driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-5856</td>
|
|
<td>A-32610665<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=0c0622914ba53cdcb6e79e85f64bfdf7762c0368">
|
|
QC-CR#1094078</a></td>
|
|
<td>High</td>
|
|
<td>None*</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-5857</td>
|
|
<td>A-34386529<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=d9d2c405d46ca27b25ed55a8dbd02bd1e633e2d5">
|
|
QC-CR#1094140</a></td>
|
|
<td>High</td>
|
|
<td>None*</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="id-in-kernel-networking-subsystem">Information disclosure vulnerability
|
|
in kernel networking subsystem</h3>
|
|
<p>An information disclosure vulnerability in the kernel networking subsystem
|
|
could enable a local proximate attacker to gain access to sensitive
|
|
information. This issue is rated as High because it could be used to access
|
|
data without permission.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2014-8709</td>
|
|
<td>A-34077221<br>
|
|
<a
|
|
href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=338f977f4eb441e69bb9a46eaa0ac715c931a67f">
|
|
Upstream kernel</a></td>
|
|
<td>High</td>
|
|
<td>Nexus Player</td>
|
|
<td>Nov 9, 2014</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-mediatek-driver">Information disclosure vulnerability in MediaTek
|
|
driver</h3>
|
|
<p>An information disclosure vulnerability in the MediaTek driver could enable a
|
|
local malicious application to access data outside of its permission levels.
|
|
This issue is rated as High because it could be used to access sensitive data
|
|
without explicit user permission.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0529</td>
|
|
<td>A-28449427*<br>
|
|
M-ALPS02710042</td>
|
|
<td>High</td>
|
|
<td>None**</td>
|
|
<td>Apr 27, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-bootloader">Information disclosure vulnerability in
|
|
Qualcomm bootloader</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm bootloader could help
|
|
to enable a local malicious application to to execute arbitrary code within the
|
|
context of the bootloader. This issue is rated as High because it is a general
|
|
bypass for a bootloader level defense in depth or exploit mitigation
|
|
technology.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0455</td>
|
|
<td>A-32370952<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=2c00928b4884fdb0b1661bcc530d7e68c9561a2f">
|
|
QC-CR#1082755</a></td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 21, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-power-driver">Information disclosure vulnerability in
|
|
Qualcomm power driver</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm power driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as High because it could be used to access
|
|
sensitive data without explicit user permission.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8483</td>
|
|
<td>A-33745862<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=6997dcb7ade1315474855821e64782205cb0b53a">
|
|
QC-CR#1035099</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P</td>
|
|
<td>Dec 19, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-nvidia-gpu-driver">Information disclosure vulnerability in NVIDIA
|
|
GPU driver</h3>
|
|
<p>An information disclosure vulnerability in the NVIDIA GPU driver could enable a
|
|
local malicious application to access data outside of its permission levels.
|
|
This issue is rated as High because it could be used to access sensitive data
|
|
without explicit user permission.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0334</td>
|
|
<td>A-33245849*<br>
|
|
N-CVE-2017-0334</td>
|
|
<td>High</td>
|
|
<td>Pixel C</td>
|
|
<td>Nov 30, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0336</td>
|
|
<td>A-33042679*<br>
|
|
N-CVE-2017-0336</td>
|
|
<td>High</td>
|
|
<td>Pixel C</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="dos-in-kernel-cryptographic-subsystem">Denial of service vulnerability
|
|
in kernel cryptographic subsystem</h3>
|
|
<p>A denial of service vulnerability in the kernel cryptographic subsystem could
|
|
enable a remote attacker to use a specially crafted network packet to cause a
|
|
device hang or reboot. This issue is rated as High due to the possibility of
|
|
remote denial of service.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8650</td>
|
|
<td>A-33401771<br>
|
|
<a
|
|
href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f5527fffff3f002b0a6b376163613b82f69de073">
|
|
Upstream kernel</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Oct 12, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-camera-driver-(device-specific)">Elevation of privilege
|
|
vulnerability in Qualcomm camera driver (device specific)</h3>
|
|
<p>An elevation of privilege vulnerability in the Qualcomm camera driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Moderate because it first
|
|
requires compromising a privileged process and is mitigated by current platform
|
|
configurations.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8417</td>
|
|
<td>A-32342399<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=01dcc0a7cc23f23a89adf72393d5a27c6d576cd0">
|
|
QC-CR#1088824</a></td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Oct 21, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-wi-fi-driver">Information disclosure vulnerability in
|
|
Qualcomm Wi-Fi driver</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm Wi-Fi driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0461</td>
|
|
<td>A-32073794<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ce5d6f84420a2e6ca6aad6b866992970dd313a65">
|
|
QC-CR#1100132</a></td>
|
|
<td>Moderate</td>
|
|
<td>Android One, Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 9, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0459</td>
|
|
<td>A-32644895<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=rel/msm-3.18&id=ffacf6e2dc41b6063c3564791ed7a2f903e7e3b7">
|
|
QC-CR#1091939</a></td>
|
|
<td>Moderate</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Nov 3, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0531</td>
|
|
<td>A-32877245<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=530f3a0fd837ed105eddaf99810bc13d97dc4302">
|
|
QC-CR#1087469</a></td>
|
|
<td>Moderate</td>
|
|
<td>Android One, Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Nov 13, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-mediatek-video-codec-driver">Information disclosure vulnerability
|
|
in MediaTek video codec driver</h3>
|
|
<p>An information disclosure vulnerability in the MediaTek video codec driver
|
|
could enable a local malicious application to access data outside of its
|
|
permission levels. This issue is rated as Moderate because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0532</td>
|
|
<td>A-32370398*<br>
|
|
M-ALPS03069985</td>
|
|
<td>Moderate</td>
|
|
<td>None**</td>
|
|
<td>Oct 22, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<p>** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.</p>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-video-driver">Information disclosure vulnerability in
|
|
Qualcomm video driver</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm video driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0533</td>
|
|
<td>A-32509422<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f">
|
|
QC-CR#1088206</a></td>
|
|
<td>Moderate</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 27, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0534</td>
|
|
<td>A-32508732<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f">
|
|
QC-CR#1088206</a></td>
|
|
<td>Moderate</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 28, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8416</td>
|
|
<td>A-32510746<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f">
|
|
QC-CR#1088206</a></td>
|
|
<td>Moderate</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 28, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8478</td>
|
|
<td>A-32511270<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f">
|
|
QC-CR#1088206</a></td>
|
|
<td>Moderate</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Oct 28, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-camera-driver">Information disclosure vulnerability in
|
|
Qualcomm camera driver</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm camera driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8413</td>
|
|
<td>A-32709702<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=bc77232707df371ff6bab9350ae39676535c0e9d">
|
|
QC-CR#518731</a></td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 4, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8477</td>
|
|
<td>A-32720522<br>
|
|
<a
|
|
href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=33c9042e38506b04461fa99e304482bc20923508">
|
|
QC-CR#1090007</a>
|
|
[<a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=96145eb5f0631f0e105d47abebc8f940f7621eeb">2</a>]</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-htc-sound-codec-driver">Information disclosure vulnerability in
|
|
HTC sound codec driver</h3>
|
|
<p>An information disclosure vulnerability in the HTC sound codec driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0535</td>
|
|
<td>A-33547247*</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 9</td>
|
|
<td>Dec 11, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="id-in-synaptics-touchscreen-driver">Information disclosure
|
|
vulnerability in Synaptics touchscreen driver</h3>
|
|
<p>An information disclosure vulnerability in the Synaptics touchscreen driver
|
|
could enable a local malicious application to access data outside of its
|
|
permission levels. This issue is rated as Moderate because it first requires
|
|
compromising a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0536</td>
|
|
<td>A-33555878*</td>
|
|
<td>Moderate</td>
|
|
<td>Android One, Nexus 5X, Nexus 6P, Nexus 9, Pixel, Pixel XL</td>
|
|
<td>Dec 12, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="id-in-kernel-usb-gadget-driver">Information disclosure vulnerability in
|
|
kernel USB gadget driver</h3>
|
|
<p>An information disclosure vulnerability in the kernel USB gadget driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0537</td>
|
|
<td>A-31614969*</td>
|
|
<td>Moderate</td>
|
|
<td>Pixel C</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-camera-driver-2">Information disclosure vulnerability in
|
|
Qualcomm camera driver</h3>
|
|
<p>An information disclosure vulnerability in the Qualcomm camera driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Low because it first requires compromising a
|
|
privileged process.</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0452</td>
|
|
<td>A-32873615*<br>
|
|
QC-CR#1093693</td>
|
|
<td>Low</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One</td>
|
|
<td>Nov 10, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.</p>
|
|
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
|
|
<p>This section answers common questions that may occur after reading this
|
|
bulletin.</p>
|
|
<p><strong>1. How do I determine if my device is updated to address these issues?
|
|
</strong></p>
|
|
<p>To learn how to check a device's security patch level, read the instructions on
|
|
the <a
|
|
href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel
|
|
and Nexus update schedule</a>.</p>
|
|
<ul>
|
|
<li>Security patch levels of 2017-03-01 or later address all issues associated
|
|
with the 2017-03-01 security patch level.</li>
|
|
<li>Security patch levels of 2017-03-05 or later address all issues associated
|
|
with the 2017-03-05 security patch level and all previous patch levels.
|
|
</li>
|
|
</ul>
|
|
<p>Device manufacturers that include these updates should set the patch string
|
|
level to:</p>
|
|
<ul>
|
|
<li>[ro.build.version.security_patch]:[2017-03-01]</li>
|
|
<li>[ro.build.version.security_patch]:[2017-03-05]</li>
|
|
</ul>
|
|
<p><strong>2. Why does this bulletin have two security patch levels?</strong></p>
|
|
<p>This bulletin has two security patch levels so that Android partners have the
|
|
flexibility to fix a subset of vulnerabilities that are similar across all
|
|
Android devices more quickly. Android partners are encouraged to fix all issues
|
|
in this bulletin and use the latest security patch level.</p>
|
|
<ul>
|
|
<li>Devices that use the March 1, 2017 security patch level must include all
|
|
issues associated with that security patch level, as well as fixes for all
|
|
issues reported in previous security bulletins.</li>
|
|
<li>Devices that use the security patch level of March 5, 2017 or newer must
|
|
include all applicable patches in this (and previous) security
|
|
bulletins.</li>
|
|
</ul>
|
|
<p>Partners are encouraged to bundle the fixes for all issues they are addressing
|
|
in a single update.</p>
|
|
<p><strong>3. How do I determine which Google devices are affected by each
|
|
issue?</strong></p>
|
|
<p>In the <a href="#2017-03-01-details">2017-03-01</a> and
|
|
<a href="#2017-03-05-details">2017-03-05</a>
|
|
security vulnerability details sections, each table has an <em>Updated Google
|
|
devices</em> column that covers the range of affected Google devices updated for
|
|
each issue. This column has a few options:</p>
|
|
<ul>
|
|
<li><strong>All Google devices</strong>: If an issue affects All and Pixel
|
|
devices, the table will have "All" in the <em>Updated Google devices</em>
|
|
column. "All" encapsulates the following <a
|
|
href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported
|
|
devices</a>: Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One,
|
|
Nexus Player, Pixel C, Pixel, and Pixel XL.</li>
|
|
<li><strong>Some Google devices</strong>: If an issue doesn't affect all Google
|
|
devices, the affected Google devices are listed in the <em>Updated Google
|
|
devices</em> column.</li>
|
|
<li><strong>No Google devices</strong>: If no Google devices running Android 7.0
|
|
are affected by the issue, the table will have "None" in the <em>Updated Google
|
|
devices</em> column. </li>
|
|
</ul>
|
|
<p><strong>4. What do the entries in the references column map to?</strong></p>
|
|
<p>Entries under the <em>References</em> column of the vulnerability details table
|
|
may contain a prefix identifying the organization to which the reference value
|
|
belongs. These prefixes map as follows:</p>
|
|
<table>
|
|
<tr>
|
|
<th>Prefix</th>
|
|
<th>Reference</th>
|
|
</tr>
|
|
<tr>
|
|
<td>A-</td>
|
|
<td>Android bug ID</td>
|
|
</tr>
|
|
<tr>
|
|
<td>QC-</td>
|
|
<td>Qualcomm reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>M-</td>
|
|
<td>MediaTek reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>N-</td>
|
|
<td>NVIDIA reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>B-</td>
|
|
<td>Broadcom reference number</td>
|
|
</tr>
|
|
</table>
|
|
<h2 id="revisions">Revisions</h2>
|
|
<ul>
|
|
<li>March 06, 2017: Bulletin published.</li>
|
|
<li>March 07, 2017: Bulletin revised to include AOSP links.</li>
|
|
</ul>
|
|
|
|
|
|
</body>
|
|
</html>
|