Google Android prior 2016-07-05 on Nexus 5X/Nexus 6P Qualcomm USB Driver f_serial.c access control

Summaryinfo

A vulnerability has been found in Google Android on Nexus 5X/Nexus 6P and classified as critical. The impacted element is an unknown function of the file drivers/usb/gadget/f_serial.c of the component Qualcomm USB Driver. The manipulation leads to access control. This vulnerability is documented as CVE-2016-2502. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Google Android on Nexus 5X/Nexus 6P (Smartphone Operating System). This issue affects an unknown part of the file drivers/usb/gadget/f_serial.c of the component Qualcomm USB Driver. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

drivers/usb/gadget/f_serial.c in the Qualcomm USB driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a large size in a GSER_IOCTL ioctl call, aka Android internal bug 27657963 and Qualcomm internal bug CR997044.

The weakness was released 07/06/2016 as Android Security Bulletin - July 2016 as confirmed security bulletin (Website). It is possible to read the advisory at source.android.com. The identification of this vulnerability is CVE-2016-2502 since 02/18/2016. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/01/2022). It is expected to see the exploit prices for this product increasing in the near future.The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 2016-07-05 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-88897, VDB-88898, VDB-88899 and VDB-88900. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion