CVE-2014-9870: Critical severity Google Android vulnerability
The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, aka Android internal bug 28749743 and Qualcomm internal bug CR561044.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects ARM systems running Linux kernel versions before 3.11. It was used in Android before 2016-08-05 on Nexus 5 and Nexus 7 (2013) devices.
What does an attacker need to exploit it?
An attacker needs local access and must be able to run a crafted application. No privileges are required before exploitation, but user interaction is required according to the CVSS vector.
What is the impact of successful exploitation?
A local attacker can gain elevated privileges. The assigned CVSS vector indicates high impact to confidentiality, integrity, and availability.
What should organizations do if they identify an affected device?
Apply the available patch or update to a version that includes the fix. Until patched, restrict installation and execution of untrusted applications on affected devices.