Google Android prior 2016-07-05 Qualcomm Innovation Center QuIC drivers/gpu/msm/kgsl.c KGSL_MEMFLAGS_GPUREADONLY access control

Summaryinfo

A vulnerability classified as problematic was found in Google Android. This issue affects some unknown processing of the file drivers/gpu/msm/kgsl.c of the component Qualcomm Innovation Center QuIC. Such manipulation of the argument KGSL_MEMFLAGS_GPUREADONLY leads to access control. This vulnerability is listed as CVE-2016-2067. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Google Android (Smartphone Operating System). It has been rated as critical. Affected by this issue is an unknown function of the file drivers/gpu/msm/kgsl.c of the component Qualcomm Innovation Center QuIC. The manipulation of the argument KGSL_MEMFLAGS_GPUREADONLY with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers to gain privileges by leveraging accidental read-write mappings, aka Qualcomm internal bug CR988993.

The weakness was presented 07/06/2016 as Android Security Bulletin - July 2016 as confirmed security bulletin (Website). The advisory is shared for download at source.android.com. This vulnerability is handled as CVE-2016-2067 since 01/25/2016. The exploitation is known to be easy. The attack needs to be approached locally. The successful exploitation requires a simple authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/01/2022). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2016-07-05 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See VDB-88897, VDB-88898, VDB-88899 and VDB-88900 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion