771 lines
30 KiB
HTML
771 lines
30 KiB
HTML
<html devsite>
|
||
<head>
|
||
<title>Nexus Security Bulletin - August 2015</title>
|
||
<meta name="project_path" value="/_project.yaml" />
|
||
<meta name="book_path" value="/_book.yaml" />
|
||
</head>
|
||
<body>
|
||
<!--
|
||
Copyright 2017 The Android Open Source Project
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
-->
|
||
|
||
|
||
|
||
<p><em>Published August 13, 2015</em></p>
|
||
|
||
<p>We have released a security update to Nexus devices through an over-the-air
|
||
(OTA) update as part of our Android Security Bulletin Monthly Release process.
|
||
The Nexus firmware images have also been released to the <a href="https://developers.google.com/android/nexus/images">Google Developer site</a>. Builds LMY48I or later address these issues. Partners were notified about these
|
||
issues on June 25, 2015 or earlier.</p>
|
||
|
||
<p>The most severe of these issues is a Critical security vulnerability that could
|
||
enable remote code execution on an affected device through multiple methods
|
||
such as email, web browsing, and MMS when processing media files. The
|
||
<a href="/security/overview/updates-resources.html#severity">severity
|
||
assessment</a> is based on the effect that exploiting the vulnerability would
|
||
possibly have on an affected device, assuming the platform and service
|
||
mitigations are disabled for development purposes or if successfully bypassed.</p>
|
||
|
||
<h2 id=mitigations>Mitigations</h2>
|
||
|
||
|
||
<p>This is a summary of the mitigations provided by the <a href="/security/enhancements/index.html">Android security platform</a> and service protections such as SafetyNet. These capabilities reduce the
|
||
likelihood that security vulnerabilities can be successfully exploited on
|
||
Android.</p>
|
||
|
||
<ul>
|
||
<li> Exploitation for many issues on Android is made more difficult by enhancements
|
||
in newer versions of the Android platform. We encourage all users to update to
|
||
the latest version of Android where possible.
|
||
<li> The Android Security team is actively monitoring for abuse with Verify Apps and
|
||
SafetyNet which will warn about potentially harmful applications about to be
|
||
installed. Device rooting tools are prohibited within Google Play. To protect
|
||
users who install applications from outside of Google Play, Verify Apps is
|
||
enabled by default and will warn users about known rooting applications. Verify
|
||
Apps attempts to identify and block installation of known malicious
|
||
applications that exploit a privilege escalation vulnerability. If such an
|
||
application has already been installed, Verify Apps will notify the user and
|
||
attempt to remove any such applications.
|
||
<li> As appropriate, Google has updated the Hangouts and Messenger applications so
|
||
that media is not automatically passed to vulnerable processes (such as
|
||
mediaserver.)
|
||
</ul>
|
||
|
||
<h2 id=acknowledgements>Acknowledgements</h2>
|
||
|
||
|
||
<p>We would like to thank these researchers for their contributions:</p>
|
||
|
||
<ul>
|
||
<li> Joshua Drake: CVE-2015-1538, CVE-2015-3826
|
||
<li> Ben Hawkes: CVE-2015-3836
|
||
<li> Alexandru Blanda: CVE-2015-3832
|
||
<li> Michał Bednarski: CVE-2015-3831, CVE-2015-3844, CVE-2015-1541
|
||
<li> Alex Copot: CVE-2015-1536
|
||
<li> Alex Eubanks: CVE-2015-0973
|
||
<li> Roee Hay and Or Peles: CVE-2015-3837
|
||
<li> Guang Gong: CVE-2015-3834
|
||
<li> Gal Beniamini: CVE-2015-3835
|
||
<li> Wish Wu*: CVE-2015-3842
|
||
<li> Artem Chaykin: CVE-2015-3843
|
||
</ul>
|
||
|
||
<p>*Wish is also our very first <a href="https://www.google.com/about/appsecurity/android-rewards/">Android Security Rewards</a> recipient!</p>
|
||
|
||
<h3 id=integer_overflows_during_mp4_atom_processing>Integer overflows during MP4 atom processing</h3>
|
||
|
||
|
||
<p>There are several potential integer overflows in libstagefright that could
|
||
occur during MP4 atom processing, leading to memory corruption and potentially
|
||
remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access. Note that under our previous severity rating
|
||
guidelines, this was rated as a High severity vulnerability and was reported to
|
||
partners as such. Under our new guidelines, published in June 2015, it is a
|
||
Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1538</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/cf1581c66c2ad8c5b1aaca2e43e350cf5974f46d">ANDROID-20139950</a> [<a href="https://android.googlesource.com/platform/frameworks/av/+/2434839bbd168469f80dd9a22f1328bc81046398">2</a>]</td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id=an_integer_underflow_in_esds_processing>An integer underflow in ESDS processing</h3>
|
||
|
||
|
||
<p>There is a potential integer underflow in libstagefright that could occur
|
||
during ESDS atom processing, leading to memory corruption and potentially
|
||
remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access. Note that under our previous severity rating
|
||
guidelines, this was rated as a High severity vulnerability and was reported to
|
||
partners as such. Under our new guidelines, published in June 2015, it is a
|
||
Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1539</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/5e751957ba692658b7f67eb03ae5ddb2cd3d970c">ANDROID-20139950</a></td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=integer_overflow_in_libstagefright_when_parsing_the_mpeg4_tx3g_atom>Integer overflow in libstagefright when parsing the MPEG4 tx3g atom</h3>
|
||
|
||
|
||
<p>There is a potential integer overflow in libstagefright that could occur during
|
||
MPEG4 tx3g data processing, leading to memory corruption and potentially remote
|
||
code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access.</p>
|
||
|
||
<p>Note that under our previous severity rating guidelines, this was rated as a
|
||
High severity vulnerability and was reported to partners as such. Under our new
|
||
guidelines, published in June 2015, it is a Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3824</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/463a6f807e187828442949d1924e143cf07778c6">ANDROID-20923261</a> </td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=integer_underflow_in_libstagefright_when_processing_mpeg4_covr_atoms>Integer underflow in libstagefright when processing MPEG4 covr atoms</h3>
|
||
|
||
|
||
<p>There is a potential integer underflow in libstagefright that could occur
|
||
during MPEG4 data processing, leading to memory corruption and potentially
|
||
remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access.</p>
|
||
|
||
<p>Note that under our previous severity rating guidelines, this was rated as a
|
||
High severity vulnerability and was reported to partners as such. Under our new
|
||
guidelines, published in June 2015, it is a Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3827</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/f4a88c8ed4f8186b3d6e2852993e063fc33ff231">ANDROID-20923261</a></td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=integer_underflow_in_libstagefright_if_size_is_below_6_while_processing_3gpp_metadata>Integer underflow in libstagefright if size is below 6 while processing 3GPP
|
||
metadata</h3>
|
||
|
||
|
||
<p>There is a potential integer underflow in libstagefright that could occur
|
||
during 3GPP data processing, leading to memory corruption and potentially
|
||
remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access. Note that under our previous severity rating
|
||
guidelines, this was rated as a High severity vulnerability and was reported to
|
||
partners as such. Under our new guidelines, published in June 2015, it is a
|
||
Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3828</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/f4f7e0c102819f039ebb1972b3dba1d3186bc1d1">ANDROID-20923261</a></td>
|
||
<td>Critical</td>
|
||
<td>5.0 and above</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=integer_overflow_in_libstagefright_processing_mpeg4_covr_atoms_when_chunk_data_size_is_size_max>Integer overflow in libstagefright processing MPEG4 covr atoms when
|
||
chunk_data_size is SIZE_MAX</h3>
|
||
|
||
|
||
<p>There is a potential integer overflow in libstagefright that could occur during
|
||
MPEG4 covr data processing, leading to memory corruption and potentially
|
||
remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access. Note that under our previous severity rating
|
||
guidelines, this was rated as a High severity vulnerability and was reported to
|
||
partners as such. Under our new guidelines, published in June 2015, it is a
|
||
Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3829</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/2674a7218eaa3c87f2ee26d26da5b9170e10f859">ANDROID-20923261</a></td>
|
||
<td>Critical</td>
|
||
<td>5.0 and above</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=buffer_overflow_in_sonivox_parse_wave>Buffer overflow in Sonivox Parse_wave</h3>
|
||
|
||
|
||
<p>There is a potential buffer overflow in Sonivox that could occur during XMF
|
||
data processing, leading to memory corruption and potentially remote code
|
||
execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access. Note that under our previous severity rating
|
||
guidelines, this was rated as a High severity vulnerability and was reported to
|
||
partners as such. Under our new guidelines, published in June 2015, it is a
|
||
Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3836</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/sonivox/+/e999f077f6ef59d20282f1e04786816a31fb8be6">ANDROID-21132860</a></td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=buffer_overflows_in_libstagefright_mpeg4extractor_cpp>Buffer overflows in libstagefright MPEG4Extractor.cpp</h3>
|
||
|
||
|
||
<p>There are several buffer overflows in libstagefright that could occur during
|
||
MP4 processing, leading to memory corruption and potentially remote code
|
||
execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API and there are
|
||
multiple applications that allow it to be reached with remote content, most
|
||
notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as a Critical severity due to the possibility of remote
|
||
code execution as the privileged mediaserver service. While mediaserver is
|
||
guarded with SELinux, it does have access to audio and video streams as well as
|
||
access to privileged kernel driver device nodes on many devices that 3rd party
|
||
apps cannot normally access.</p>
|
||
|
||
<p>Initially this issue was reported as a local exploit (not remotely accessible).
|
||
Note that under our previous severity rating guidelines, this was rated as a
|
||
Moderate severity vulnerability and was reported to partners as such. Under our
|
||
new guidelines, published in June 2015, it is a Critical severity issue.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3832</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b">ANDROID-19641538</a></td>
|
||
<td>Critical</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=buffer_overflow_in_mediaserver_bpmediahttpconnection>Buffer overflow in mediaserver BpMediaHTTPConnection</h3>
|
||
|
||
|
||
<p>There is a potential buffer overflow in BpMediaHTTPConnection when
|
||
processing data provided by another application, leading to memory corruption
|
||
and potentially code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API. We don’t believe
|
||
the issue is remotely exploitable.</p>
|
||
|
||
<p>This issue is rated as a High severity due to the possibility of code execution
|
||
as the privileged mediaserver service, from a local application. While
|
||
mediaserver is guarded with SELinux, it does have access to audio and video
|
||
streams as well as access to privileged kernel driver device nodes on many
|
||
devices that 3rd party apps cannot normally access.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3831</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/51504928746edff6c94a1c498cf99c0a83bedaed">ANDROID-19400722</a></td>
|
||
<td>High</td>
|
||
<td>5.0 and 5.1</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=vulnerability_in_libpng_overflow_in_png_read_idat_data>Vulnerability in libpng: Overflow in png_Read_IDAT_data</h3>
|
||
|
||
|
||
<p>There is a potential buffer overflow that could occur in reading IDAT data
|
||
within the png_read_IDAT_data() function in libpng, leading to memory
|
||
corruption and potentially remote code execution within an application using
|
||
this method.</p>
|
||
|
||
<p>The affected functionality is provided as an application API. There may be
|
||
applications that allow it to be reached with remote content, most notably
|
||
messaging applications and browsers.</p>
|
||
|
||
<p>This issue is rated as a High severity due to the possibility of remote code
|
||
execution as an unprivileged application.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-0973</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/libpng/+/dd0ed46397a05ae69dc8c401f5711f0db0a964fa">ANDROID-19499430</a></td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=remotely_exploitable_memcpy_overflow_in_p2p_add_device_in_wpa_supplicant>Remotely exploitable memcpy() overflow in p2p_add_device() in wpa_supplicant</h3>
|
||
|
||
|
||
<p>When wpa_supplicant is operating in WLAN Direct mode, it's vulnerable to
|
||
potential remote code execution due to an overflow in the p2p_add_device()
|
||
method. Successful exploitation could result in code execution as the 'wifi'
|
||
user in Android.</p>
|
||
|
||
<p>There are several mitigations that can effect successful exploitation of this
|
||
issue:</p>
|
||
|
||
<p>- WLAN Direct is not enabled by default on most Android devices</p>
|
||
|
||
<p>- Exploitation requires an attacker to be locally proximate (within WiFi range)</p>
|
||
|
||
<p>- The wpa_supplicant process runs as the 'wifi' user which has limited access
|
||
to the system</p>
|
||
|
||
<p>- Remote exploitation is mitigated by ASLR on Android 4.1 and later devices.</p>
|
||
|
||
<p>- The wpa_supplicant process is tightly constrained by SELinux policy on
|
||
Android 5.0 and greater</p>
|
||
|
||
<p>This issue is rated as High severity due to the possibility of remote code
|
||
execution. While the 'wifi' service does have capabilities that are not
|
||
normally accessible to 3rd party apps which could rate this as Critical, we
|
||
believe the limited capabilities and level of mitigation warrant decreasing the
|
||
severity to High.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1863</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/wpa_supplicant_8/+/4cf0f2d0d869c35a9ec4432861d5efa8ead4279c">ANDROID-20076874</a></td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=memory_corruption_in_opensslx509certificate_deserialization>Memory Corruption in OpenSSLX509Certificate Deserialization</h3>
|
||
|
||
|
||
<p>A malicious local application can send an Intent which, when deserialized by
|
||
the receiving application, can decrement a value at an arbitrary memory
|
||
address, leading to memory corruption and potentially code execution within the
|
||
receiving application.</p>
|
||
|
||
<p>This issue is rated as High severity because it can be used to gain privileges
|
||
not accessible to a third-party application.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3837</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/conscrypt/+/edf7055461e2d7fa18de5196dca80896a56e3540">ANDROID-21437603</a></td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=buffer_overflow_in_mediaserver_bnhdcp>Buffer overflow in mediaserver BnHDCP</h3>
|
||
|
||
|
||
<p>There is a potential integer overflow in libstagefright when processing data
|
||
provided by another application, leading to memory (heap) corruption and
|
||
potentially code execution as the mediaserver process.</p>
|
||
|
||
<p>This issue is rated as High severity because it can be used to gain privileges
|
||
not accessible to a third-party application. While mediaserver is guarded with
|
||
SELinux, it does have access to audio and video streams as well as access to
|
||
privileged kernel driver device nodes on many devices that 3rd party apps
|
||
cannot normally access.</p>
|
||
|
||
<p>Note that under our previous severity rating guidelines, this was rated as a
|
||
Moderate severity vulnerability and was reported to partners as such. Under our
|
||
new guidelines, published in June 2015, it is a High severity vulnerability.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3834</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/c82e31a7039a03dca7b37c65b7890ba5c1e18ced">ANDROID-20222489</a></td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=buffer_overflow_in_libstagefright_omxnodeinstance_emptybuffer>Buffer overflow in libstagefright OMXNodeInstance::emptyBuffer</h3>
|
||
|
||
|
||
<p>There is a potential buffer overflow in libstagefright when processing data
|
||
provided by another application, leading to memory corruption and potentially
|
||
code execution as the mediaserver process.</p>
|
||
|
||
<p>This issue is rated as High severity because it can be used to gain privileges
|
||
not accessible to a third-party application. While mediaserver is guarded with
|
||
SELinux, it does have access to audio and video streams as well as access to
|
||
privileged kernel driver device nodes on many devices that 3rd party apps
|
||
cannot normally access.</p>
|
||
|
||
<p>Note that under our previous severity rating guidelines, this was rated as a
|
||
Moderate severity vulnerability and was reported to partners as such. Under our
|
||
new guidelines, published in June 2015, it is a High severity vulnerability.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3835</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/086d84f45ab7b64d1a7ed7ac8ba5833664a6a5ab">ANDROID-20634516</a> [<a href="https://android.googlesource.com/platform/frameworks/av/+/3cb1b6944e776863aea316e25fdc16d7f9962902">2</a>]</td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=heap_overflow_in_mediaserver_audiopolicymanager_getinputforattr>Heap overflow in mediaserver AudioPolicyManager::getInputForAttr()</h3>
|
||
|
||
|
||
<p>There is a heap overflow in mediaserver's Audio Policy Service that could allow
|
||
a local application to execute arbitrary code in mediaserver's process.</p>
|
||
|
||
<p>The affected functionality is provided as an application API. We don’t
|
||
believe the issue is remotely exploitable.</p>
|
||
|
||
<p>This issue is rated as a High severity due to the possibility of code execution
|
||
as the privileged mediaserver service, from a local application. While
|
||
mediaserver is guarded with SELinux, it does have access to audio and video
|
||
streams as well as access to privileged kernel driver device nodes on many
|
||
devices that 3rd party apps cannot normally access.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3842</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/aeea52da00d210587fb3ed895de3d5f2e0264c88">ANDROID-21953516</a></td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=applications_can_intercept_or_emulate_sim_commands_to_telephony>Applications can intercept or emulate SIM commands to Telephony</h3>
|
||
|
||
|
||
<p>There is a vulnerability in the SIM Toolkit (STK) framework that could allow
|
||
apps to intercept or emulate certain STK SIM commands to Android's Telephony
|
||
subsystem.</p>
|
||
|
||
<p>This issue is rated at a High severity because it could allow an unprivileged
|
||
app to access capabilities or data normally protected by a "signature" or
|
||
"system" level permission.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3843</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/opt/telephony/+/b48581401259439dc5ef6dcf8b0f303e4cbefbe9">ANDROID-21697171</a> [<a href="https://android.googlesource.com/platform/packages/apps/Stk/+/1d8e00160c07ae308e5b460214eb2a425b93ccf7">2</a>, <a href="https://android.googlesource.com/platform/frameworks/base/+/a5e904e7eb3aaec532de83ca52e24af18e0496b4">3</a>, <a href="https://android.googlesource.com/platform/packages/services/Telephony/+/fcb1d13c320dd1a6350bc7af3166929b4d54a456">4</a>]</td>
|
||
<td>High</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=vulnerability_in_bitmap_unmarshalling>Vulnerability in Bitmap unmarshalling</h3>
|
||
|
||
|
||
<p>An integer overflow in Bitmap_createFromParcel() could allow an app to either
|
||
crash the system_server process or read memory data from system_server.</p>
|
||
|
||
<p>This issue is rated as Moderate severity due to the possibility of leaking
|
||
sensitive data from the system_server process to an unprivileged local process.
|
||
While this type of vulnerability would normally be rated as High severity, the
|
||
severity has been reduced because the data that is leaked in a successful
|
||
attack cannot be controlled by the attacking process and the consequence of an
|
||
unsuccessful attack is to render the device temporarily unusable (requiring a
|
||
reboot).</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1536</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/d44e5bde18a41beda39d49189bef7f2ba7c8f3cb">ANDROID-19666945</a></td>
|
||
<td>Moderate</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=appwidgetserviceimpl_can_create_intentsender_with_system_privileges>AppWidgetServiceImpl can create IntentSender with system privileges</h3>
|
||
|
||
|
||
<p>There is a vulnerability in AppWidgetServiceImpl in the Settings app that
|
||
allows an app to grant itself a URI permission by specifying
|
||
FLAG_GRANT_READ/WRITE_URI_PERMISSION. For example, this could be exploited to
|
||
read contact data without the READ_CONTACTS permission.</p>
|
||
|
||
<p>This is rated as a Moderate severity vulnerability because it can allow a local
|
||
app to access data normally protected by permissions with a "dangerous"
|
||
protection level.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1541 </td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/0b98d304c467184602b4c6bce76fda0b0274bc07">ANDROID-19618745</a></td>
|
||
<td>Moderate</td>
|
||
<td>5.1 </td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=mitigation_bypass_of_restrictions_on_getrecenttasks>Mitigation bypass of restrictions on getRecentTasks()</h3>
|
||
|
||
|
||
<p>A local application can reliably determine the foreground application,
|
||
circumventing the getRecentTasks() restriction introduced in Android 5.0.</p>
|
||
|
||
<p>This is rated as a moderate severity vulnerability because it can allow a local
|
||
app to access data normally protected by permissions with a "dangerous"
|
||
protection level.</p>
|
||
|
||
<p>We believe this vulnerability was first described publicly on
|
||
<a href="http://stackoverflow.com/questions/24625936/getrunningtasks-doesnt-work-in-android-l">Stack Overflow</a>.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3833 </td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/aaa0fee0d7a8da347a0c47cef5249c70efee209e">ANDROID-20034603</a></td>
|
||
<td>Moderate</td>
|
||
<td>5.0 and 5.1 </td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=activitymanagerservice_getprocessrecordlocked_may_load_a_system_uid_application_into_the_wrong_process>ActivityManagerService.getProcessRecordLocked() may load a system UID
|
||
application into the wrong process</h3>
|
||
|
||
|
||
<p>ActivityManager's getProcessRecordLocked() method doesn't properly verify that
|
||
an application's process name matches the corresponding package name. In some
|
||
cases, this can allow ActivityManager to load the wrong process for certain
|
||
tasks.</p>
|
||
|
||
<p>The implications are that an app can prevent Settings from being loaded or
|
||
inject parameters for Settings fragments. We don't believe that this
|
||
vulnerability can be used to execute arbitrary code as the "system" user.</p>
|
||
|
||
<p>While the ability to access capabilities normally only accessible to "system"
|
||
would be rated as a High severity, we rated this one as a Moderate due to the
|
||
limited level of access granted by the vulnerability.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3844 </td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/e3cde784e3d99966f313fe00dcecf191f6a44a31">ANDROID-21669445</a></td>
|
||
<td>Moderate</td>
|
||
<td>5.1 and below</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=unbounded_buffer_read_in_libstagefright_while_parsing_3gpp_metadata>Unbounded buffer read in libstagefright while parsing 3GPP metadata</h3>
|
||
|
||
|
||
<p>An integer underflow during parsing of 3GPP data can result in a read operation
|
||
overrunning a buffer, causing mediaserver to crash.</p>
|
||
|
||
<p>This issue was originally rated as a High severity and was reported to partners
|
||
as such, but after further investigation it has been downgraded to Low severity
|
||
as the impact is limited to crashing mediaserver.</p>
|
||
<table>
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Bug(s) with AOSP links</th>
|
||
<th>Severity</th>
|
||
<th>Affected versions</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-3826</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/f4f7e0c102819f039ebb1972b3dba1d3186bc1d1">ANDROID-20923261</a></td>
|
||
<td>Low</td>
|
||
<td>5.0 and 5.1</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h2 id=revisions>Revisions</h2>
|
||
|
||
|
||
<ul>
|
||
<li> August 13, 2015: Originally Published
|
||
|
||
</body>
|
||
</html>
|