A vulnerability was found in Google Android (Smartphone Operating System) (affected version unknown) and classified as critical. Affected by this issue is an unknown functionality of the component Qualcomm Touch Controller. The manipulation as part of a Variable leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the touch controller function in all Qualcomm products in all Android releases from CAF using the Linux kernel, a variable may be controlled by the user and can lead to a buffer overflow.

The bug was discovered 06/05/2017. The weakness was released 08/16/2017 (Website). The advisory is available at source.android.com. This vulnerability is handled as CVE-2017-6421 since 03/01/2017. Local access is required to approach this attack. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 72 days. During that time the estimated underground price was around $5k-$25k.

Applying a patch is able to eliminate this problem.

Entries connected to this vulnerability are available at 102302, 102303, 102304 and 102305.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion