CVE-2014-9865: Critical severity Google Android vulnerability
drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly restrict user-space input, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28748271 and Qualcomm internal bug CR550013.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The issue is identified in Qualcomm components on Nexus 5 and Nexus 7 (2013) devices running Android versions before 2016-08-05.
What does an attacker need to exploit this issue?
An attacker needs to get a crafted application executed on the device. The CVSS vector indicates local access, no required privileges, and user interaction.
What is the likely impact of successful exploitation?
A successful exploit can allow an attacker to gain privileges, with high impact to confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available, and the affected Android versions are those before 2016-08-05.