CVE-2016-6734: Critical severity Google Android vulnerability
An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30907120. References: NVIDIA N-CVE-2016-6734.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs to run a malicious application locally on the Android device. The CVSS vector indicates no privileges are required, but user interaction is required.
What is the potential impact if exploitation succeeds?
A malicious application could execute arbitrary code in the kernel context, resulting in full compromise of confidentiality, integrity, and availability. The compromise may be persistent and could require reflashing the operating system to repair the device.
Which systems should be prioritized for remediation?
Android devices using the affected NVIDIA GPU driver and running software from before 2016-11-05 should be prioritized. The provided data identifies Google Android but does not list specific device models or Android release versions.