Google Android IPA Driver IOCTL Command use after free

Summaryinfo

A vulnerability classified as critical has been found in Google Android. This affects an unknown function of the component IPA Driver. Performing a manipulation as part of IOCTL Command results in use after free. This vulnerability was named CVE-2017-14877. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Google Android (Smartphone Operating System) (version now known). It has been classified as critical. This affects some unknown processing of the component IPA Driver. The manipulation as part of a IOCTL Command leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPA_IOC_QUERY_RT_TBL_INDEX while another sends an ioctl cmd IPA_IOC_DEL_RT_RULE, a use-after-free condition may occur.

The bug was discovered 02/05/2018. The weakness was presented 03/30/2018 (Website). The advisory is shared at source.android.com. This vulnerability is uniquely identified as CVE-2017-14877 since 09/28/2017. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/24/2023). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 53 days. During that time the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem.

See VDB-110104, VDB-113150, VDB-113156 and VDB-113159 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion