CVE-2015-9166: High severity Google Android vulnerability
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, DRM provisioning mechanisms used in QSEE applications have a feature to prevent further provisioning. This is done by creating an SFS file called 'finalizeprovflag.data' at the end of provisioning. When this feature is enabled, provisioning calls check for the existence of the file in order to decide whether to do provisioning or not. Current implementation allows provisioning without sufficient checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Create the SFS file named 'finalize_prov_flag.data' at the end of provisioning so subsequent provisioning calls detect it and prevent further provisioning.
DRM provisioning mechanisms in QSEE applications SFS file finalize_prov_flag.data = present
Event History
Frequently Asked Questions
What is CVE-2015-9166?
CVE-2015-9166 is a vulnerability found in Android versions before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, and SD 810, which could allow remote attackers to execute arbitrary code within the context of the kernel.
What is the severity of CVE-2015-9166?
The severity of CVE-2015-9166 is high with a CVSS score of 7.5.
How does CVE-2015-9166 impact Android devices?
CVE-2015-9166 could allow remote attackers to execute arbitrary code within the context of the kernel on affected Android devices.
Which Qualcomm Snapdragon devices are affected by CVE-2015-9166?
Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, and SD 810 devices are affected by CVE-2015-9166.
How can I mitigate the vulnerability in CVE-2015-9166?
To mitigate the vulnerability in CVE-2015-9166, it is recommended to update your Android device to a version after 2018-04-05 or apply the appropriate security patch level provided by the device manufacturer.