CVE-2017-11002: Medium severity Google Android vulnerability

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access is required. No privileges are required, but user interaction is required.

Q: What is the likely security impact if exploitation succeeds?

The CVSS assessment rates confidentiality impact as high. It does not identify integrity or availability impact.

Q: Which systems should be evaluated for exposure?

Evaluate Qualcomm products running Android releases from CAF that use the Linux kernel. The issue is described as affecting all such Qualcomm products.

Published Sep 5, 2017

Updated

In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing a vendor sub-command, a buffer over-read can occur.

Affected Software

2 affected components

Google Android<=8.0

Google Android

Event History

Sep 5, 2017

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 21, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access is required. No privileges are required, but user interaction is required.

What is the likely security impact if exploitation succeeds?

The CVSS assessment rates confidentiality impact as high. It does not identify integrity or availability impact.

Which systems should be evaluated for exposure?

Evaluate Qualcomm products running Android releases from CAF that use the Linux kernel. The issue is described as affecting all such Qualcomm products.

CVE-2017-11002: Medium severity Google Android vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact if exploitation succeeds?

Which systems should be evaluated for exposure?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact if exploitation succeeds?

Which systems should be evaluated for exposure?