CVE-2017-0403: High severity android vulnerability
An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402548.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed?
The affected products listed are Android devices using Kernel-3.10 or Kernel-3.18. Exploitation is local, so exposure depends on an attacker being able to run a malicious application on the device rather than reach the device remotely.
What must an attacker do to exploit this issue?
An attacker needs local execution through a malicious application, user interaction, and an initial compromise of a privileged process. The CVSS vector also indicates high attack complexity and no privileges required by the attacker.
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution in the kernel context, with high impacts to confidentiality, integrity, and availability.