CVE-2016-6695: Buffer Overflow
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted visualizer data length, aka Qualcomm internal bug CR 1033540.
Affected Software
Event History
Frequently Asked Questions
Which Android devices are affected?
Devices running Android builds before 2016-10-05 that include the Qualcomm QDSP6v2 driver are affected. The issue is in the driver source file sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c.
What does an attacker need to exploit this issue?
The vulnerability can be triggered remotely without authentication or user interaction by supplying a crafted visualizer data length. The reported impact includes denial of service and potentially other unspecified effects.
Is this a default-configuration concern?
The available data does not identify any required non-default configuration. Exposure depends on whether the Android build includes the affected Qualcomm QDSP6v2 driver and predates 2016-10-05.
How can I determine whether a device is at risk?
Check whether the device runs an Android security update level earlier than 2016-10-05 and uses an Android build containing the Qualcomm QDSP6v2 driver. Review the vendor's kernel source or update documentation for the fix associated with Qualcomm internal bug CR 1033540.