CVE-2017-13287: Input Validation
Published Apr 2, 2018
·Updated
In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71714464.
Affected Software
7 affected components
Google Android=6.0
Google Android=7.0
Google Android=7.1.1
Google Android=7.1.2
Google Android=8.0
Google Android=8.1
Google Android
Event History
Apr 2, 2018
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Apr 4, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Android releases are affected?
The affected releases are Android 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.
2
What level of access does an attacker need?
Exploitation is local and requires low privileges. It does not require user interaction or additional execution privileges.
3
How can I track this issue in Android security information?
This issue is identified as Android ID A-71714464 and was published in the April 2018 Android security bulletin.