CVE-2017-8281: Race Condition
Published Sep 5, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event status via DCI.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
Which devices are in scope?
The issue affects Qualcomm products running Android releases from CAF that use the Linux kernel. The listed software is Google Android.
2
What does an attacker need to exploit this?
The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation also has high attack complexity and involves querying event status through DCI.
3
What is the expected security impact?
The vulnerability can expose already freed memory, resulting in high confidentiality impact. The CVSS vector lists no integrity or availability impact.