1839 lines
59 KiB
HTML
1839 lines
59 KiB
HTML
<html devsite>
|
|
<head>
|
|
<title>Android Security Bulletin—February 2017</title>
|
|
<meta name="project_path" value="/_project.yaml" />
|
|
<meta name="book_path" value="/_book.yaml" />
|
|
</head>
|
|
<body>
|
|
<!--
|
|
Copyright 2017 The Android Open Source Project
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
-->
|
|
|
|
|
|
<p><em>Published February 06, 2017 | Updated February 8, 2017</em></p>
|
|
<p>
|
|
The Android Security Bulletin contains details of security vulnerabilities
|
|
affecting Android devices. Alongside the bulletin, we have released a security
|
|
update to Google devices through an over-the-air (OTA) update. The Google device
|
|
firmware images have also been released to the <a
|
|
href="https://developers.google.com/android/nexus/images">Google Developer
|
|
site</a>. Security patch levels of February 05, 2017 or later address all of
|
|
these issues. Refer to the <a
|
|
href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel
|
|
and Nexus update schedule</a> to learn how to check a device's security patch
|
|
level.
|
|
</p>
|
|
<p>
|
|
Partners were notified of the issues described in the bulletin on January 03,
|
|
2017 or earlier. Source code patches for these issues have been released to the
|
|
Android Open Source Project (AOSP) repository and linked from this bulletin.
|
|
This bulletin also includes links to patches outside of AOSP.
|
|
</p>
|
|
<p>
|
|
The most severe of these issues is a Critical security vulnerability that could
|
|
enable remote code execution on an affected device through multiple methods such
|
|
as email, web browsing, and MMS when processing media files. The
|
|
<a href="/security/overview/updates-resources.html#severity">severity
|
|
assessment</a> is based on the effect that exploiting the vulnerability would
|
|
possibly have on an affected device, assuming the platform and service
|
|
mitigations are disabled for development purposes or if successfully bypassed.
|
|
</p>
|
|
<p>
|
|
We have had no reports of active customer exploitation or abuse of these newly
|
|
reported issues. Refer to the <a
|
|
href="#mitigations">Android and Google service
|
|
mitigations</a> section for details on the <a
|
|
href="/security/enhancements/index.html">Android
|
|
security platform protections</a> and service protections such as <a
|
|
href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>,
|
|
which improve the security of the Android platform.
|
|
</p>
|
|
<p>
|
|
We encourage all customers to accept these updates to their devices.
|
|
</p>
|
|
<h2 id="announcements">Announcements</h2>
|
|
<ul>
|
|
<li>This bulletin has two security patch level strings to provide Android
|
|
partners with the flexibility to more quickly fix a subset of vulnerabilities
|
|
that are similar across all Android devices. See <a
|
|
href="#common-questions-and-answers">Common questions and answers</a> for
|
|
additional information:
|
|
<ul>
|
|
<li><strong>2017-02-01</strong>: Partial security patch level string. This
|
|
security patch level string indicates that all issues associated with 2017-02-01
|
|
(and all previous security patch level strings) are addressed.</li>
|
|
<li><strong>2017-02-05</strong>: Complete security patch level string. This
|
|
security patch level string indicates that all issues associated with 2017-02-01
|
|
and 2017-02-05 (and all previous security patch level strings) are addressed.</li>
|
|
</ul>
|
|
</li>
|
|
<li>Supported Google devices will receive a single OTA update with the February
|
|
05, 2017 security patch level.</li>
|
|
</ul>
|
|
|
|
<h2 id="mitigations">Android and Google service mitigations</h2>
|
|
<p>This is a summary of the mitigations provided by the <a
|
|
href="/security/enhancements/index.html">Android
|
|
security platform</a> and service protections, such as SafetyNet. These
|
|
capabilities reduce the likelihood that security vulnerabilities could be
|
|
successfully exploited on Android.</p>
|
|
<ul>
|
|
<li>Exploitation for many issues on Android is made more difficult by
|
|
enhancements in newer versions of the Android platform. We encourage all users
|
|
to update to the latest version of Android where possible.</li>
|
|
<li>The Android Security team actively monitors for abuse with
|
|
<a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">
|
|
Verify Apps and SafetyNet</a>, which are designed to warn users about
|
|
<a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">
|
|
Potentially Harmful Applications</a>. Verify Apps is enabled by default on devices with
|
|
<a href="http://www.android.com/gms">Google Mobile Services</a> and is especially
|
|
important for users who install applications from outside of Google Play. Device
|
|
rooting tools are prohibited within Google Play, but Verify Apps warns users
|
|
when they attempt to install a detected rooting application—no matter where it
|
|
comes from. Additionally, Verify Apps attempts to identify and block
|
|
installation of known malicious applications that exploit a privilege escalation
|
|
vulnerability. If such an application has already been installed, Verify Apps
|
|
will notify the user and attempt to remove the detected application.</li>
|
|
<li>As appropriate, Google Hangouts and Messenger applications do not
|
|
automatically pass media to processes such as Mediaserver.</li>
|
|
</ul>
|
|
<h2 id="acknowledgements">Acknowledgements</h2>
|
|
<p>
|
|
We would like to thank these researchers for their contributions:
|
|
</p>
|
|
<ul>
|
|
<li>Daniel Dakhno: CVE-2017-0420</li>
|
|
<li>Daniel Micay of Copperhead Security: CVE-2017-0410</li>
|
|
<li><a href="http://www.linkedin.com/in/dzima">Dzmitry Lukyanenka</a>:
|
|
CVE-2017-0414</li>
|
|
<li>Frank Liberato of Chrome: CVE-2017-0409</li>
|
|
<li>Gal Beniamini of Project Zero: CVE-2017-0411, CVE-2017-0412</li>
|
|
<li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>)
|
|
and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360
|
|
Technology Co. Ltd.: CVE-2017-0434, CVE-2017-0446, CVE-2017-0447, CVE-2017-0432</li>
|
|
<li>Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>)
|
|
of Alpha Team, <a href="http://www.360.com">Qihoo 360 Technology Co.Ltd</a>:
|
|
CVE-2017-0415</li>
|
|
<li><a href="mailto:arnow117@gmail.com">Hanxiang Wen</a>,
|
|
<a href="mailto:vancouverdou@gmail.com">Wenke Dou</a>, Mingjian Zhou (
|
|
<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), and Xuxian Jiang
|
|
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0418</li>
|
|
<li>Hao Chen and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd.:
|
|
CVE-2017-0437, CVE-2017-0438, CVE-2017-0439, CVE-2016-8419, CVE-2016-8420,
|
|
CVE-2016-8421, CVE-2017-0441, CVE-2017-0442, CVE-2016-8476, CVE-2017-0443</li>
|
|
<li>Jeff Sharkey of Google: CVE-2017-0421, CVE-2017-0423</li>
|
|
<li>Jeff Trim: CVE-2017-0422</li>
|
|
<li>Jianqiang Zhao (
|
|
<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and
|
|
<a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360: CVE-2017-0445</li>
|
|
<li>ma.la and Nikolay Elenkov of LINE Corporation: CVE-2016-5552</li>
|
|
<li>Max Spector of Google: CVE-2017-0416</li>
|
|
<li>Mingjian Zhou (
|
|
<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Yuqi Lu (
|
|
<a href="https://twitter.com/nikos233__">@nikos233</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0425</li>
|
|
<li>Qidan He (何淇丹) (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>)
|
|
and Di Shen (申迪) (<a href="https://twitter.com/returnsme">@returnsme</a>) of
|
|
KeenLab, Tencent (腾讯科恩实验室): CVE-2017-0427</li>
|
|
<li>Sagi Kedmi of IBM X-Force Research: CVE-2017-0433</li>
|
|
<li>Scott Bauer (<a href="http://twitter.com/ScottyBauer1">@ScottyBauer1</a>)
|
|
and Daniel Micay of Copperhead Security: CVE-2017-0405</li>
|
|
<li>Seven Shen (<a href="https://twitter.com/lingtongshen">@lingtongshen</a>) of
|
|
Trend Micro Mobile Threat Research Team: CVE-2017-0449, CVE-2016-8418</li>
|
|
<li><a href="mailto:segfault5514@gmail.com">Tong Lin</a>,
|
|
<a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, Chiachih Wu (
|
|
<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0436, CVE-2016-8481, CVE-2017-0435</li>
|
|
<li>V.E.O (<a href="https://twitter.com/vysea">@VYSEa</a>) of
|
|
<a href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile">Mobile
|
|
Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro</a>:
|
|
CVE-2017-0424</li>
|
|
<li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of
|
|
Alibaba Inc.: CVE-2017-0407</li>
|
|
<li><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a>,
|
|
<a href="mailto:hlhan@bupt.edu.cn">Hongli Han</a>, Mingjian Zhou (
|
|
<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), and Xuxian Jiang
|
|
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0450</li>
|
|
<li><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a>, Yuqi Lu (
|
|
<a href="https://twitter.com/nikos233__">@nikos233</a>), Mingjian Zhou (
|
|
<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), and Xuxian Jiang
|
|
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0417</li>
|
|
<li>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) (
|
|
<a href="http://www.weibo.com/wishlinux">吴潍浠</a> 此彼) of Ant-financial Light-Year
|
|
Security Lab: CVE-2017-0408</li>
|
|
<li><a href="mailto:yaojun8558363@gmail.com">Yao Jun</a>,
|
|
<a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, Chiachih Wu (
|
|
<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-8480</li>
|
|
<li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, Chiachih Wu (
|
|
<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0444</li>
|
|
<li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>,
|
|
<a href="mailto:segfault5514@gmail.com">Tong Lin</a>, Chiachih Wu (
|
|
<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0428</li>
|
|
<li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>,
|
|
<a href="mailto:wisedd@gmail.com">Xiaodong Wang</a>, Chiachih Wu (
|
|
<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
|
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2017-0448, CVE-2017-0429</li>
|
|
<li><a href="mailto:zhouzhenster@gmail.com">Zhen Zhou</a> (
|
|
<a href="https://twitter.com/henices">@henices</a>) and
|
|
<a href="mailto:sundaywind2004@gmail.com">Zhixin Li</a> of
|
|
<a href="http://www.nsfocus.com">NSFocus</a>: CVE-2017-0406</li>
|
|
</ul>
|
|
<p>
|
|
We would also like to thank the following for their contributions to this
|
|
bulletin:
|
|
</p><ul>
|
|
<li>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬) of Baidu X-Lab
|
|
(百度安全实验室)</li>
|
|
</ul>
|
|
|
|
<h2 id="2017-02-01-details">2017-02-01 security patch level—Vulnerability
|
|
details</h2>
|
|
<p>
|
|
In the sections below, we provide details for each of the security
|
|
vulnerabilities that apply to the 2017-02-01 patch level. There is a description
|
|
of the issue, a severity rationale, and a table with the CVE, associated
|
|
references, severity, updated Google devices, updated AOSP versions (where
|
|
applicable), and date reported. When available, we will link the public change
|
|
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
|
changes relate to a single bug, additional references are linked to numbers
|
|
following the bug ID.</p>
|
|
|
|
|
|
<h3 id="rce-in-surfaceflinger">Remote code execution vulnerability in
|
|
Surfaceflinger</h3>
|
|
<p>
|
|
A remote code execution vulnerability in Surfaceflinger could enable an
|
|
attacker using a specially crafted file to cause memory corruption during media
|
|
file and data processing. This issue is rated as Critical due to the
|
|
possibility of remote code execution within the context of the Surfaceflinger
|
|
process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0405</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/16110b86db164e8d2b6864fed58f0385fe7d0979">
|
|
A-31960359</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Oct 4, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-mediaserver">Remote code execution vulnerability in
|
|
Mediaserver</h3>
|
|
<p>
|
|
A remote code execution vulnerability in Mediaserver could enable an attacker
|
|
using a specially crafted file to cause memory corruption during media file and
|
|
data processing. This issue is rated as Critical due to the possibility of
|
|
remote code execution within the context of the Mediaserver process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0406</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libhevc/+/fed702734d86801cc86b4865a57e2f2028c4b575">
|
|
A-32915871</a>
|
|
[<a href="https://android.googlesource.com/platform/external/libhevc/+/df7b56457184600e3d2b7cbac87ebe7001f7cb48">2</a>]</td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 14, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0407</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libhevc/+/7546c106004910a4583b2d7d03c6498ecf383da7">
|
|
A-32873375</a></td>
|
|
<td>Critical</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 12, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-libgdx">Remote code execution vulnerability in libgdx</h3>
|
|
<p>
|
|
A remote code execution vulnerability in libgdx could enable an attacker using
|
|
a specially crafted file to execute arbitrary code in the context of an
|
|
unprivileged process. This issue is rated as High due to the possibility of
|
|
remote code execution in an application that uses this library.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0408</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libgdx/+/e6da772e70c9754966aabf4ddac73bb99eb1742b">
|
|
A-32769670</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>7.1.1</td>
|
|
<td>Nov 9, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="rce-in-libstagefright">Remote code execution vulnerability in
|
|
libstagefright</h3>
|
|
<p>
|
|
A remote code execution vulnerability in libstagefright could enable an
|
|
attacker using a specially crafted file to execute arbitrary code in the
|
|
context of an unprivileged process. This issue is rated as High due to the
|
|
possibility of remote code execution in an application that uses this library.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0409</td>
|
|
<td><a href="https://android.googlesource.com/platform/external/libavc/+/72886b6964f6539908c8e127cd13c3091d2e5a8b">
|
|
A-31999646</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-java.net">Elevation of privilege vulnerability in Java.Net</h3>
|
|
<p>
|
|
An elevation of privilege in the Java.Net library could enable malicious web
|
|
content to redirect a user to another website without explicit permission. This
|
|
issue is rated as High because it is a remote bypass of user interaction
|
|
requirements.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-5552</td>
|
|
<td><a href="https://android.googlesource.com/platform/libcore/+/4b3f2c6c5b84f80fae8eeeb46727811e055715ea">
|
|
A-31858037</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Sep 30, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-framework-apis">Elevation of privilege vulnerability in
|
|
Framework APIs</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Framework APIs could enable a
|
|
local malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as High because it could be used to
|
|
gain local access to elevated capabilities, which are not normally accessible
|
|
to a third-party application.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0410</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/b4d6b292bce7d82c93fd454078dedf5a1302b9fa">
|
|
A-31929765</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 2, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0411</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/203725e4d58e16334d84998c1483c374f541ed9f">
|
|
A-33042690</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/base/+/31a06019d13d7b00ca35fc8512191c643acb8e84">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Nov 21, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0412</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/203725e4d58e16334d84998c1483c374f541ed9f">
|
|
A-33039926</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/base/+/31a06019d13d7b00ca35fc8512191c643acb8e84">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Nov 21, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="eop-in-mediaserver">Elevation of privilege vulnerability in
|
|
Mediaserver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in Mediaserver could enable a local
|
|
malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as High because it could be used to
|
|
gain local access to elevated capabilities, which are not normally accessible
|
|
to a third-party application.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0415</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/2e16d5fac149dab3c3e8f1b2ca89f45cf55a7b34">
|
|
A-32706020</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 4, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-audioserver">Elevation of privilege vulnerability in
|
|
Audioserver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in Audioserver could enable a local
|
|
malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as High because it could be used to
|
|
gain local access to elevated capabilities, which are not normally accessible
|
|
to a third-party application.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0416</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b0bcddb44d992e74140a3f5eedc7177977ea8e34">
|
|
A-32886609</a>
|
|
[<a href="https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0417</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b0bcddb44d992e74140a3f5eedc7177977ea8e34">
|
|
A-32705438</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0418</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b0bcddb44d992e74140a3f5eedc7177977ea8e34">
|
|
A-32703959</a>
|
|
[<a href="https://android.googlesource.com/platform/hardware/libhardware/+/534098cb29e1e4151ba2ed83d6a911d0b6f48522">2</a>]</td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0419</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/a155de4d70e0b9ac8fc02b2bdcbb2e8e6cca46ff">
|
|
A-32220769</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 15, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h3 id="id-in-aosp-mail">Information disclosure vulnerability in AOSP Mail</h3>
|
|
<p>
|
|
An information disclosure vulnerability in AOSP Mail could enable a local
|
|
malicious application to bypass operating system protections that isolate
|
|
application data from other applications. This issue is rated as High because
|
|
it could be used to gain access to data that the application does not have
|
|
access to.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0420</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/2073799a165e6aa15117f8ad76bb0c7618b13909">
|
|
A-32615212</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Sep 12, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-aosp-messaging">Information disclosure vulnerability in AOSP
|
|
Messaging</h3>
|
|
<p>
|
|
An information disclosure vulnerability in AOSP Messaging could enable a local
|
|
malicious application to bypass operating system protections that isolate
|
|
application data from other applications. This issue is rated as High because
|
|
it could be used to gain access to data that the application does not have
|
|
access to.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0413</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Messaging/+/74059eb379ea07b9c7f46bf2112a60de8e4cfc8e">
|
|
A-32161610</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 13, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0414</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Messaging/+/30ab77f42d20c33c0aa9e6ffd2b164d096db32dd">
|
|
A-32807795</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 10, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-framework-apis">Information disclosure vulnerability in Framework
|
|
APIs</h3>
|
|
<p>
|
|
An information disclosure vulnerability in the Framework APIs could enable a
|
|
local malicious application to bypass operating system protections that isolate
|
|
application data from other applications. This issue is rated as High because
|
|
it could be used to gain access to data that the application does not have
|
|
access to.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0421</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/858064e946dc8dbf76bff9387e847e211703e336">
|
|
A-32555637</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="dos-in-bionic-dns">Denial of service vulnerability in Bionic DNS</h3>
|
|
<p>
|
|
A denial of service vulnerability in Bionic DNS could enable a remote attacker
|
|
to use a specially crafted network packet to cause a device hang or reboot.
|
|
This issue is rated as High due to the possibility of remote denial of service.
|
|
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0422</td>
|
|
<td><a href="https://android.googlesource.com/platform/bionic/+/dba3df609436d7697305735818f0a840a49f1a0d">
|
|
A-32322088</a></td>
|
|
<td>High</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 20, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-bluetooth">Elevation of privilege vulnerability in
|
|
Bluetooth</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in Bluetooth could enable a proximate
|
|
attacker to manage access to documents on the device. This issue is rated as
|
|
Moderate because it first requires exploitation of a separate vulnerability in
|
|
the Bluetooth stack.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0423</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Bluetooth/+/4c1f39e1cf203cb9db7b85e75b5fc32ec7132083">
|
|
A-32612586</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 2, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-aosp-messaging-2">Information disclosure vulnerability in AOSP
|
|
Messaging</h3>
|
|
<p>
|
|
An information disclosure vulnerability in AOSP Messaging could enable a remote
|
|
attacker using a special crafted file to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it is a general bypass for a
|
|
user level defense in depth or exploit mitigation technology in a privileged
|
|
process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0424</td>
|
|
<td><a href="https://android.googlesource.com/platform/packages/apps/Messaging/+/e9b7e3a6b7a8886693d298401a20788816a5afdc">
|
|
A-32322450</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Oct 20, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-audioserver">Information disclosure vulnerability in
|
|
Audioserver</h3>
|
|
<p>
|
|
An information disclosure vulnerability in Audioserver could enable a local
|
|
malicious application to access data outside of its permission levels. This
|
|
issue is rated as Moderate because it could be used to access sensitive data
|
|
without permission.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0425</td>
|
|
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/a155de4d70e0b9ac8fc02b2bdcbb2e8e6cca46ff">
|
|
A-32720785</a></td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-filesystem">Information disclosure vulnerability in
|
|
Filesystem</h3>
|
|
<p>
|
|
An information disclosure vulnerability in the Filesystem could enable a local
|
|
malicious application to access data outside of its permission levels. This
|
|
issue is rated as Moderate because it could be used to access sensitive data
|
|
without permission.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<col width="10%">
|
|
<col width="19%">
|
|
<col width="18%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Updated AOSP versions</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0426</td>
|
|
<td><a href="https://android.googlesource.com/platform/system/sepolicy/+/ae46511bfa62b56938b3df824bb2ee737dceaa7a">
|
|
A-32799236</a>
|
|
[<a href="https://android.googlesource.com/platform/system/core/+/0e7324e9095a209d4f06ba00812b2b2976fe2846">2</a>]</td>
|
|
<td>Moderate</td>
|
|
<td>All</td>
|
|
<td>7.0, 7.1.1</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h2 id="2017-02-05-details">2017-02-05 security patch level—Vulnerability
|
|
details</h2>
|
|
<p>
|
|
In the sections below, we provide details for each of the security
|
|
vulnerabilities that apply to the 2017-02-05 patch level.
|
|
There is a description of
|
|
the issue, a severity rationale, and a table with the CVE, associated
|
|
references, severity, updated Google devices, updated AOSP versions (where
|
|
applicable), and date reported. When available, we will link the public change
|
|
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
|
changes relate to a single bug, additional references are linked to numbers
|
|
following the bug ID.</p>
|
|
|
|
|
|
<h3 id="rce-in-qualcomm-crypto-driver">Remote code execution vulnerability in
|
|
Qualcomm crypto driver</h3>
|
|
<p>
|
|
A remote code execution vulnerability in the Qualcomm crypto driver could
|
|
enable a remote attacker to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as Critical due to the possibility of remote code
|
|
execution in the context of the kernel.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8418</td>
|
|
<td>A-32652894<br>
|
|
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=8f8066581a8e575a7d57d27f36c4db63f91ca48f">
|
|
QC-CR#1077457</a></td>
|
|
<td>Critical</td>
|
|
<td>None*</td>
|
|
<td>Oct 10, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-file-system">Elevation of privilege vulnerability in
|
|
kernel file system</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the kernel file system could enable
|
|
a local malicious application to execute arbitrary code within the context of
|
|
the kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0427</td>
|
|
<td>A-31495866*</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus
|
|
Player, Pixel, Pixel XL</td>
|
|
<td>Sep 13, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-nvidia-gpu-driver">Elevation of privilege vulnerability in
|
|
NVIDIA GPU driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a
|
|
local malicious application to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as Critical due to the possibility of a local
|
|
permanent device compromise, which may require reflashing the operating system
|
|
to repair the device.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0428</td>
|
|
<td>A-32401526*<br>
|
|
N-CVE-2017-0428</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 9</td>
|
|
<td>Oct 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0429</td>
|
|
<td>A-32636619*<br>
|
|
N-CVE-2017-0429</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 9</td>
|
|
<td>Nov 3, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-networking-subsystem">Elevation of privilege
|
|
vulnerability in kernel networking subsystem</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the kernel networking subsystem
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Critical due to the possibility
|
|
of a local permanent device compromise, which may require reflashing the
|
|
operating system to repair the device.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2014-9914</td>
|
|
<td>A-32882659<br>
|
|
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9709674e68646cee5a24e3000b3558d25412203a">
|
|
Upstream kernel</a></td>
|
|
<td>Critical</td>
|
|
<td>Nexus 6, Nexus Player</td>
|
|
<td>Nov 9, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-broadcom-wi-fi-driver">Elevation of privilege vulnerability in
|
|
Broadcom Wi-Fi driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Critical due to the possibility
|
|
of a local permanent device compromise, which may require reflashing the
|
|
operating system to repair the device.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0430</td>
|
|
<td>A-32838767*<br>
|
|
B-RB#107459</td>
|
|
<td>Critical</td>
|
|
<td>Nexus 6, Nexus 6P, Nexus 9, Pixel C, Nexus Player</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm
|
|
components</h3>
|
|
<p>
|
|
The following vulnerability affects Qualcomm components and is described in
|
|
further detail in Qualcomm AMSS September 2016 security bulletin.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity*</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0431</td>
|
|
<td>A-32573899**</td>
|
|
<td>Critical</td>
|
|
<td>None***</td>
|
|
<td>Qualcomm internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The severity rating for these vulnerabilities was determined by the vendor.
|
|
</p>
|
|
<p>
|
|
** The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
<p>
|
|
*** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-mediatek-driver">Elevation of privilege vulnerability in
|
|
MediaTek driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the MediaTek driver could enable a
|
|
local malicious application to execute arbitrary code within the context of the
|
|
kernel. This issue is rated as High because it first requires compromising a
|
|
privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0432</td>
|
|
<td>A-28332719*<br>
|
|
M-ALPS02708925</td>
|
|
<td>High</td>
|
|
<td>None**</td>
|
|
<td>Apr 21, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
<p>
|
|
** Supported Google devices on Android 7.0 or later that have installed all
|
|
available updates are not affected by this vulnerability.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-synaptics-touchscreen-driver">Elevation of privilege
|
|
vulnerability in Synaptics touchscreen driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Synaptics touchscreen driver
|
|
could enable a local malicious application to execute arbitrary code within the
|
|
context of the touchscreen chipset. This issue is rated as High because it
|
|
first requires compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0433</td>
|
|
<td>A-31913571*</td>
|
|
<td>High</td>
|
|
<td>Nexus 6P, Nexus 9, Android One, Pixel, Pixel XL</td>
|
|
<td>Sep 8, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0434</td>
|
|
<td>A-33001936*</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Nov 18, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3
|
|
id="eop-in-qualcomm-secure-execution-environment-communicator-driver">Elevation
|
|
of privilege vulnerability in Qualcomm Secure Execution Environment
|
|
Communicator driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Qualcomm Secure Execution
|
|
Environment Communicator drive could enable a local malicious application to
|
|
execute arbitrary code within the context of the kernel. This issue is rated as
|
|
High because it first requires compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8480</td>
|
|
<td>A-31804432<br>
|
|
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=0ed0f061bcd71940ed65de2ba46e37e709e31471">
|
|
QC-CR#1086186</a>
|
|
[<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=cd70f6025a7bbce89af7a7abf4c40a219fdea406">2</a>]</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Sep 28, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-sound-driver">Elevation of privilege vulnerability in
|
|
Qualcomm sound driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Qualcomm sound driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8481</td>
|
|
<td>A-31906415*<br>
|
|
QC-CR#1078000</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Oct 1, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0435</td>
|
|
<td>A-31906657*<br>
|
|
QC-CR#1078000</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Oct 1, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0436</td>
|
|
<td>A-32624661*<br>
|
|
QC-CR#1078000</td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
|
|
<td>Nov 2, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-qualcomm-wi-fi-driver">Elevation of privilege vulnerability in
|
|
Qualcomm Wi-Fi driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0437</td>
|
|
<td>A-32402310<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77">
|
|
QC-CR#1092497</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0438</td>
|
|
<td>A-32402604<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77">
|
|
QC-CR#1092497</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0439</td>
|
|
<td>A-32450647<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=81b6b5538d3227ed4b925fcceedb109abb2a4c61">
|
|
QC-CR#1092059</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 25, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8419</td>
|
|
<td>A-32454494<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9ba50d536227666a5b6abd51f2b122675d950488">
|
|
QC-CR#1087209</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 26, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8420</td>
|
|
<td>A-32451171<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c6597e015a7ce5ee71d3725fc55e64fc50923f4e">
|
|
QC-CR#1087807</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 26, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8421</td>
|
|
<td>A-32451104<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=61a5cdb9adc96645583f528ac923e6e59f3abbcb">
|
|
QC-CR#1087797</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Oct 26, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0440</td>
|
|
<td>A-33252788<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=10f0051f7b3b9a7635b0762a8cf102f595f7a268">
|
|
QC-CR#1095770</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 11, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0441</td>
|
|
<td>A-32872662<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=da87131740351b833f17f05dfa859977bc1e7684">
|
|
QC-CR#1095009</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 11, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0442</td>
|
|
<td>A-32871330<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77">
|
|
QC-CR#1092497</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 13, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0443</td>
|
|
<td>A-32877494<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77">
|
|
QC-CR#1092497</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 13, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8476</td>
|
|
<td>A-32879283<br>
|
|
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=bfe8035bce6fec72ed1d064b94529fce8fb09799">
|
|
QC-CR#1091940</a></td>
|
|
<td>High</td>
|
|
<td>Nexus 5X, Pixel, Pixel XL</td>
|
|
<td>Nov 14, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="eop-in-realtek-sound-driver">Elevation of privilege vulnerability in
|
|
Realtek sound driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Realtek sound driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0444</td>
|
|
<td>A-32705232*</td>
|
|
<td>High</td>
|
|
<td>Nexus 9</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-htc-touchscreen-driver">Elevation of privilege vulnerability in
|
|
HTC touchscreen driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the HTC touchscreen driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as High because it first requires
|
|
compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0445</td>
|
|
<td>A-32769717*</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Nov 9, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0446</td>
|
|
<td>A-32917445*</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0447</td>
|
|
<td>A-32919560*</td>
|
|
<td>High</td>
|
|
<td>Pixel, Pixel XL</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="id-in-nvidia-video-driver">Information disclosure vulnerability in
|
|
NVIDIA video driver</h3>
|
|
<p>
|
|
An information disclosure vulnerability in the NVIDIA video driver could enable
|
|
a local malicious application to access data outside of its permission levels.
|
|
This issue is rated as High because it could be used to access sensitive data
|
|
without explicit user permission.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0448</td>
|
|
<td>A-32721029*<br>
|
|
N-CVE-2017-0448</td>
|
|
<td>High</td>
|
|
<td>Nexus 9</td>
|
|
<td>Nov 7, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-broadcom-wi-fi-driver-2">Elevation of privilege vulnerability in
|
|
Broadcom Wi-Fi driver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could
|
|
enable a local malicious application to execute arbitrary code within the
|
|
context of the kernel. This issue is rated as Moderate because it first
|
|
requires compromising a privileged process and is mitigated by current platform
|
|
configurations.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0449</td>
|
|
<td>A-31707909*<br>
|
|
B-RB#32094</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 6, Nexus 6P</td>
|
|
<td>Sep 23, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-audioserver-2">Elevation of privilege vulnerability in
|
|
Audioserver</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in Audioserver could enable a local
|
|
malicious application to execute arbitrary code within the context of a
|
|
privileged process. This issue is rated as Moderate because it is mitigated by
|
|
current platform configurations.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0450</td>
|
|
<td>A-32917432*</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 9</td>
|
|
<td>Nov 15, 2016</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="eop-in-kernel-file-system-2">Elevation of privilege vulnerability in
|
|
kernel file system</h3>
|
|
<p>
|
|
An elevation of privilege vulnerability in the kernel file system could enable
|
|
a local malicious application to bypass protections that prevent an escalation
|
|
of privileges. This issue is rated as Moderate because it is a general bypass
|
|
for a user level defense in depth or exploit mitigation technology.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-10044</td>
|
|
<td>A-31711619*</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus
|
|
Player, Pixel, Pixel XL</td>
|
|
<td>Google internal</td>
|
|
</tr>
|
|
</table>
|
|
<p>
|
|
* The patch for this issue is not publicly available. The update is contained
|
|
in the latest binary drivers for Nexus devices available from the
|
|
<a href="https://developers.google.com/android/nexus/drivers">
|
|
Google Developer site</a>.
|
|
</p>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-secure-execution-environment-communicator">Information
|
|
disclosure vulnerability in Qualcomm Secure Execution Environment
|
|
Communicator</h3>
|
|
<p>
|
|
An information disclosure vulnerability in the Qualcomm Secure Execution
|
|
Environment Communicator could enable a local malicious application to access
|
|
data outside of its permission levels. This issue is rated as Moderate because
|
|
it first requires compromising a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2016-8414</td>
|
|
<td>A-31704078<br>
|
|
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=320970d3da9b091e96746424c44649a91852a846">
|
|
QC-CR#1076407</a></td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Sep 23, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
<h3 id="id-in-qualcomm-sound-driver">Information disclosure vulnerability in
|
|
Qualcomm sound driver</h3>
|
|
<p>
|
|
An information disclosure vulnerability in the Qualcomm sound driver could
|
|
enable a local malicious application to access data outside of its permission
|
|
levels. This issue is rated as Moderate because it first requires compromising
|
|
a privileged process.
|
|
</p>
|
|
|
|
<table>
|
|
<col width="19%">
|
|
<col width="20%">
|
|
<col width="10%">
|
|
<col width="23%">
|
|
<col width="17%">
|
|
<tr>
|
|
<th>CVE</th>
|
|
<th>References</th>
|
|
<th>Severity</th>
|
|
<th>Updated Google devices</th>
|
|
<th>Date reported</th>
|
|
</tr>
|
|
<tr>
|
|
<td>CVE-2017-0451</td>
|
|
<td>A-31796345<br>
|
|
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=59f55cd40b5f44941afc78b78e5bf81ad3dd723e">
|
|
QC-CR#1073129</a>
|
|
[<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=35346beb2d8882115f698ab22a96803552b5c57e">2</a>]</td>
|
|
<td>Moderate</td>
|
|
<td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
|
|
<td>Sep 27, 2016</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
|
|
<p>This section answers common questions that may occur after reading this
|
|
bulletin.</p>
|
|
<p><strong>1. How do I determine if my device is updated to address these
|
|
issues?</strong></p>
|
|
<p>To learn how to check a device's security patch level, read the instructions on
|
|
the <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">
|
|
Pixel and Nexus update schedule</a>.</p>
|
|
<ul>
|
|
<li>Security patch levels of 2017-02-01 or later address all issues associated
|
|
with the 2017-02-01 security patch level.</li>
|
|
<li>Security patch levels of 2017-02-05 or later address all issues associated
|
|
with the 2017-02-05 security patch level and all previous patch levels.
|
|
</li>
|
|
</ul>
|
|
<p>Device manufacturers that include these updates should set the patch string
|
|
level to:</p>
|
|
<ul>
|
|
<li><code>[ro.build.version.security_patch]:[2017-02-01]</code></li>
|
|
<li><code>[ro.build.version.security_patch]:[2017-02-05]</code></li>
|
|
</ul>
|
|
|
|
<p><strong>2. Why does this bulletin have two security patch levels?</strong></p>
|
|
|
|
<p>This bulletin has two security patch levels so that Android partners have the
|
|
flexibility to fix a subset of vulnerabilities that are similar across all
|
|
Android devices more quickly. Android partners are encouraged to fix all issues
|
|
in this bulletin and use the latest security patch level.</p>
|
|
<ul>
|
|
<li>Devices that use the February 1, 2017 security patch level must include all
|
|
issues associated with that security patch level, as well as fixes for all
|
|
issues reported in previous security bulletins.</li>
|
|
<li>Devices that use the security patch level of February 5, 2017 or newer must
|
|
include all applicable patches in this (and previous) security
|
|
bulletins.</li>
|
|
</ul>
|
|
<p>Partners are encouraged to bundle the fixes for all issues they are addressing
|
|
in a single update.</p>
|
|
<p><strong>3. How do I determine which Google devices are affected by each
|
|
issue?</strong></p>
|
|
<p>In the <a href="#2017-02-01-details">2017-02-01</a> and
|
|
<a href="#2017-02-05-details">2017-02-05</a>
|
|
security vulnerability details sections, each table has an <em>Updated Google
|
|
devices</em> column that covers the range of affected Google devices updated for
|
|
each issue. This column has a few options:
|
|
</p>
|
|
<ul>
|
|
<li><strong>All Google devices</strong>: If an issue affects All and Pixel
|
|
devices, the table will have "All" in the <em>Updated Google devices</em>
|
|
column. "All" encapsulates the following <a
|
|
href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported
|
|
devices</a>: Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One,
|
|
Nexus Player, Pixel C, Pixel, and Pixel XL.</li>
|
|
<li><strong>Some Google devices</strong>: If an issue doesn't affect all Google
|
|
devices, the affected Google devices are listed in the <em>Updated Google
|
|
devices</em> column.</li>
|
|
<li><strong>No Google devices</strong>: If no Google devices running Android 7.0
|
|
are affected by the issue, the table will have "None" in the <em>Updated Google
|
|
devices</em> column.</li>
|
|
</ul>
|
|
<p><strong>4. What do the entries in the references column map to?</strong></p>
|
|
<p>Entries under the <em>References</em> column of the vulnerability details table
|
|
may contain a prefix identifying the organization to which the reference value
|
|
belongs. These prefixes map as follows:</p>
|
|
<table>
|
|
<tr>
|
|
<th>Prefix</th>
|
|
<th>Reference</th>
|
|
</tr>
|
|
<tr>
|
|
<td>A-</td>
|
|
<td>Android bug ID</td>
|
|
</tr>
|
|
<tr>
|
|
<td>QC-</td>
|
|
<td>Qualcomm reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>M-</td>
|
|
<td>MediaTek reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>N-</td>
|
|
<td>NVIDIA reference number</td>
|
|
</tr>
|
|
<tr>
|
|
<td>B-</td>
|
|
<td>Broadcom reference number</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<h2 id="revisions">Revisions</h2>
|
|
<ul>
|
|
<li>February 06, 2017: Bulletin published.</li>
|
|
<li>February 08, 2017: Bulletin revised to include AOSP links.</li>
|
|
</ul>
|
|
|
|
</body>
|
|
</html>
|