CVE-2016-6730: Critical severity Google Android vulnerability
An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30904789. References: NVIDIA N-CVE-2016-6730.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs to run a malicious application locally on the Android device. User interaction is also required according to the CVSS vector.
What could exploitation allow?
A successful exploit could allow arbitrary code execution in the kernel context, resulting in high impact to confidentiality, integrity, and availability. The issue may enable a permanent device compromise that requires reflashing the operating system to repair.
Which devices should be prioritized for remediation?
Prioritize Android devices using the NVIDIA GPU driver that have not received the 2016-11-05 security update. The affected software is identified as Google Android.