A vulnerability was found in Google Android (Smartphone Operating System) (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Qualcomm Audio Driver. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel, if a function is called with a very large length, an integer overflow could occur followed by a heap buffer overflow.

The bug was discovered 05/05/2017. The weakness was shared 08/16/2017 (Website). It is possible to read the advisory at source.android.com. This vulnerability is known as CVE-2016-5860 since 06/28/2016. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/15/2022). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 103 days. During that time the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem.

The entries 100815, 101104, 101105 and 101106 are related to this item.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion