Google Android up to 7.1.2 libstagefright SoftAACEncoder2.cpp Application access control

Summaryinfo

A vulnerability classified as critical has been found in Google Android up to 7.1.2. The impacted element is an unknown function of the file codecs/aacenc/SoftAACEncoder2.cpp of the component libstagefright. Performing a manipulation as part of Application results in access control. This vulnerability was named CVE-2017-0594. The attack needs to be approached locally. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as critical, was found in Google Android up to 7.1.2 (Smartphone Operating System). This affects some unknown processing of the file codecs/aacenc/SoftAACEncoder2.cpp of the component libstagefright. The manipulation as part of a Application leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34617444.

The bug was discovered 05/01/2017. The weakness was presented 05/12/2017 (Website). It is possible to read the advisory at android.googlesource.com. This vulnerability is uniquely identified as CVE-2017-0594 since 11/29/2016. Attacking locally is a requirement. Required for exploitation is a authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/13/2017). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 98128†). See VDB-101167, VDB-101166, VDB-101165 and VDB-101164 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 4.4.4
• 5.0.2
• 5.1.1
• 6.0
• 6.0.1
• 7.0
• 7.1.1
• 7.1.2

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion