CVE-2017-9676: Use After Free

Q: Which environments are in scope?

The issue applies to Qualcomm products running Android releases from CAF that use the Linux kernel. The provided data does not identify specific device models or fixed releases.

Q: What access would an attacker need?

Exploitation requires local access and user interaction, with no privileges required. The attack complexity is rated high.

Q: What is the likely security impact?

The CVSS vector indicates a high confidentiality impact, consistent with information disclosure. No integrity or availability impact is indicated.

Published Sep 5, 2017

Updated

In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock.

Affected Software

2 affected components

Google Android<=8.0

Google Android

Event History

Sep 5, 2017

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 21, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Which environments are in scope?

The issue applies to Qualcomm products running Android releases from CAF that use the Linux kernel. The provided data does not identify specific device models or fixed releases.

What access would an attacker need?

Exploitation requires local access and user interaction, with no privileges required. The attack complexity is rated high.

What is the likely security impact?

The CVSS vector indicates a high confidentiality impact, consistent with information disclosure. No integrity or availability impact is indicated.

CVE-2017-9676: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which environments are in scope?

What access would an attacker need?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which environments are in scope?

What access would an attacker need?

What is the likely security impact?