A vulnerability, which was classified as critical, has been found in Google Android (Smartphone Operating System) (the affected version is unknown). Affected by this issue is an unknown code of the component Inter-RAT. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.

The bug was discovered 07/01/2017. The weakness was released 08/18/2017 (Website). The advisory is shared for download at source.android.com. This vulnerability is handled as CVE-2015-9066 since 05/30/2017. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/08/2019). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 48 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

Entries connected to this vulnerability are available at 83180, 101214, 103224 and 103225.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion