Google Android Qualcomm LED Driver Application access control

Summaryinfo

A vulnerability categorized as critical has been discovered in Google Android. This issue affects some unknown processing of the component Qualcomm LED Driver. Executing a manipulation as part of Application can lead to access control. This vulnerability is handled as CVE-2016-10288. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical was found in Google Android (Smartphone Operating System) (affected version unknown). This vulnerability affects an unknown functionality of the component Qualcomm LED Driver. The manipulation as part of a Application leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33863909. References: QC-CR#1109763.

The bug was discovered 05/01/2017. The weakness was released 05/12/2017 (Website). The advisory is shared for download at source.android.com. This vulnerability was named CVE-2016-10288 since 03/28/2017. The attack needs to be approached locally. The successful exploitation needs a single authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/25/2020). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

Entries connected to this vulnerability are available at VDB-100815, VDB-101104, VDB-101105 and VDB-101106. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion