CVE-2016-6732: Critical severity Google Android vulnerability
An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30906599. References: NVIDIA N-CVE-2016-6732.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Android devices using the NVIDIA GPU driver and lacking the 2016-11-05 fix are exposed. Exploitation requires a malicious application to run locally on the device.
What does an attacker need to exploit the vulnerability?
The attacker needs local execution through a malicious app and user interaction, as indicated by the CVSS vector. Successful exploitation can execute arbitrary code in the kernel context.
What is the likely impact of successful exploitation?
An attacker could obtain kernel-level code execution, affecting confidentiality, integrity, and availability. The issue can result in a permanent device compromise that may require reflashing the operating system to repair.
How can I determine whether a device is affected?
Check whether the device uses an NVIDIA GPU driver and whether it has the Android security fix dated 2016-11-05 or later. The issue is tracked as Android ID A-30906599 and NVIDIA N-CVE-2016-6732.