CVE-2017-8277: Use After Free
In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function msmdbaregisterclient, if the client registers failed, it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation involves triggering a failed client registration and a later traversal of the list containing the freed client.
What is the potential impact of successful exploitation?
Successful exploitation can affect confidentiality, integrity, and availability, each rated High in the supplied CVSS vector. The vulnerability is a use-after-free condition in the Linux kernel code used by affected Qualcomm Android releases from CAF.
How can I determine whether a device is affected?
Review whether the device uses a Qualcomm product with an Android release from CAF and a Linux kernel containing the vulnerable msm_dba_register_client behavior. The provided data does not identify specific affected Android versions or device models.