CVE-2016-6692: Null Pointer Dereference
drivers/video/msm/mdss/mdssmdppp.c in the Qualcomm MDSS driver in Android before 2016-10-05 allows attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via unknown vectors, aka Qualcomm internal bug CR 1004933.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which Android devices are exposed?
The issue is in the Qualcomm MDSS driver, so exposure depends on whether an Android device uses the affected Qualcomm display-driver code. Android versions before the 2016-10-05 security level are identified as affected.
Does exploitation require local access, authentication, or user interaction?
The supplied vector rates the issue as network-reachable, low complexity, requiring no privileges and no user interaction. The specific attack vectors are not disclosed.
What is the impact if exploited?
An attacker can cause a denial of service through invalid pointer access. The advisory also states that unspecified additional impact may be possible, and rates confidentiality, integrity, and availability as high.
What should be done if systems may be affected?
Apply the available patch or move to an Android security level dated 2016-10-05 or later. The provided data does not describe a workaround or mitigation for systems that cannot be patched.