CVE-2017-8281: Race Condition

Q: Which devices are in scope?

The issue affects Qualcomm products running Android releases from CAF that use the Linux kernel. The listed software is Google Android.

Q: What does an attacker need to exploit this?

The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation also has high attack complexity and involves querying event status through DCI.

Q: What is the expected security impact?

The vulnerability can expose already freed memory, resulting in high confidentiality impact. The CVSS vector lists no integrity or availability impact.

Published Sep 5, 2017

Updated

In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event status via DCI.

Affected Software

2 affected components

Google Android<=8.0

Google Android

Event History

Sep 5, 2017

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 21, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Which devices are in scope?

The issue affects Qualcomm products running Android releases from CAF that use the Linux kernel. The listed software is Google Android.

What does an attacker need to exploit this?

The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation also has high attack complexity and involves querying event status through DCI.

What is the expected security impact?

The vulnerability can expose already freed memory, resulting in high confidentiality impact. The CVSS vector lists no integrity or availability impact.

CVE-2017-8281: Race Condition

Affected Software

Event History

Frequently Asked Questions

Which devices are in scope?

What does an attacker need to exploit this?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which devices are in scope?

What does an attacker need to exploit this?

What is the expected security impact?