CVE-2016-2059 in Android

Summary

The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservation

01/25/2016

Disclosure

05/05/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
92360	Google Android Qualcomm Networking race condition	362	Not defined	Official fix	CVE-2016-2059
91470	Google Android Qualcomm Networking access control	264	Not defined	Official fix	CVE-2016-2059
90675	Google Android Qualcomm Kernel ipc_router_core.c msm_ipc_router_bind_control_port QuadRooter race condition	362	Not defined	Official fix	CVE-2016-2059
83735	Linux Kernel IPC router kernel ipc_router_core.c msm_ipc_router_bind_control_port race condition	362	Not defined	Official fix	CVE-2016-2059

Sources

• MITRE
• NVD
• CVE Details