Google Android up to 4.4.3/5.0.1/5.1.0/6.x toolbox/lsof.c print_maps input validation

Summaryinfo

A vulnerability marked as problematic has been reported in Google Android up to 4.4.3/5.0.1/5.1.0/6.x. The impacted element is the function print_maps of the file toolbox/lsof.c. Performing a manipulation results in input validation. This vulnerability was named CVE-2016-3757. The attack needs to be approached locally. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Android up to 4.4.3/5.0.1/5.1.0/6.x (Smartphone Operating System). It has been classified as critical. This affects the function print_maps of the file toolbox/lsof.c. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237. NOTE: print_maps is not related to the Vic Abell lsof product.

The weakness was presented 07/06/2016 as Android Security Bulletin - July 2016 as confirmed security bulletin (Website). The advisory is shared at source.android.com. This vulnerability is uniquely identified as CVE-2016-3757 since 03/30/2016. The exploitability is told to be easy. An attack has to be approached locally. A authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 264200 (Linux Distros Unpatched Vulnerability : CVE-2016-3757), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.4.4, 5.0.2, 5.1.1 or 6.0 2016-07-01 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (264200). See VDB-88897, VDB-88898, VDB-88899 and VDB-88900 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2
• 4.2.1
• 4.2.2
• 4.3
• 4.3.1
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0
• 5.0.1
• 5.1.0
• 6.x

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion