CVE-2016-3906: Infoleak
An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30445973. References: Qualcomm QC-CR#1054344.
Affected Software
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
Android devices using affected Qualcomm components and running a version from before 2016-11-05 are in scope. The affected components include GPU, power, SMSM Point-to-Point, and sound drivers.
What must an attacker do to exploit it?
Exploitation requires a local malicious application and user interaction, according to the CVSS vector. The issue also first requires compromise of a privileged process.
What is the potential impact?
A successful attacker could access data outside the application's assigned permission levels. The listed impact is high confidentiality impact, with no integrity or availability impact.
How can I determine whether remediation is needed?
Identify whether the device uses the affected Qualcomm components and whether its Android security level predates 2016-11-05. The issue is tracked as Android ID A-30445973 and Qualcomm QC-CR#1054344.