CVE-2014-9864: Input Validation
drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not validate ioctl calls, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28747998 and Qualcomm internal bug CR561841.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The affected devices identified here are Nexus 5 and Nexus 7 (2013) devices running Android versions before 2016-08-05.
What does an attacker need to exploit this issue?
An attacker needs to get a crafted application executed on the affected device and have the user interact with it. The CVSS vector indicates no privileges are required before exploitation.
What is the impact of successful exploitation?
Successful exploitation can allow an attacker to gain privileges, with high impact to confidentiality, integrity, and availability.
What should organizations do to remediate the issue?
Apply the available patch for the affected Android components. The issue is addressed in the Android security bulletin dated 2016-08-01.