CVE-2016-6735: Critical severity Google Android vulnerability
An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30907701. References: NVIDIA N-CVE-2016-6735.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector is local, and a malicious application on the device could exploit the vulnerable NVIDIA GPU driver. The CVSS vector indicates no privileges are required, but user interaction is required.
What is the potential impact if exploitation succeeds?
Successful exploitation could allow arbitrary code execution in the kernel context, compromising confidentiality, integrity, and availability. The issue may enable a permanent device compromise that requires reflashing the operating system to repair.
Which Android devices should be assessed?
Assess Android devices that use the NVIDIA GPU driver and have not received the fix available before 2016-11-05. The provided data does not identify specific device models or Android release versions.