CVE-2016-6698: Infoleak
An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30741851. References: Qualcomm QC-CR#1058826.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Androidto a version that resolves this vulnerability.Fixed in 2016-11-05
Event History
Frequently Asked Questions
What conditions must be met for exploitation?
An attacker needs to run a malicious application locally on the Android device and must first compromise a privileged process. User interaction is also required according to the CVSS vector.
What is the likely impact if the issue is exploited?
The vulnerability can allow access to data outside the malicious application's assigned permission levels. The stated impact is confidentiality loss; integrity and availability impact are not indicated.
Which components should be considered during triage?
The affected Qualcomm components include the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver. Review devices using these components and Android versions before 2016-11-05.
What should teams do to remediate this issue?
Apply the available patch from the relevant Android security update. The issue is associated with Android ID A-30741851 and Qualcomm QC-CR#1058826.