CVE-2017-11041: High severity Google Android vulnerability
Published Sep 21, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, an output buffer is accessed in one thread and can be potentially freed in another.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Mar 9, 58506
Event
11:59 AM
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The CVSS vector indicates a local attack path with no privileges required, but user interaction is required. It is therefore not described as remotely exploitable over the network.
2
What is the potential security impact if exploitation succeeds?
The CVSS assessment rates confidentiality, integrity, and availability impacts as high. Successful exploitation could therefore potentially expose or alter data and disrupt the affected device.
3
What systems should be prioritized for review?
Prioritize Qualcomm products running Android releases from CAF that use the Linux kernel. The listed remediation references include the Android security bulletins for September 2017 and February 2018.