Summaryinfo

A vulnerability marked as critical has been reported in Google Android. This affects an unknown function of the component Full Disk Encryption. This manipulation causes inadequate encryption. This vulnerability is tracked as CVE-2014-9975. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Google Android (Smartphone Operating System) (the affected version is unknown). It has been declared as critical. Affected by this vulnerability is an unknown code of the component Full Disk Encryption. The manipulation with an unknown input leads to a inadequate encryption vulnerability. The CWE definition for the vulnerability is CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In all Qualcomm products with Android releases from CAF using the Linux kernel, a rollback vulnerability potentially exists in Full Disk Encryption.

The bug was discovered 07/01/2017. The weakness was disclosed 08/18/2017 (Website). It is possible to read the advisory at source.android.com. This vulnerability is known as CVE-2014-9975 since 05/30/2017. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 48 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 99467†). The entries VDB-101214, VDB-103224, VDB-103225 and VDB-103226 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion