CVE-2017-9676: Use After Free
Published Sep 5, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
Which environments are in scope?
The issue applies to Qualcomm products running Android releases from CAF that use the Linux kernel. The provided data does not identify specific device models or fixed releases.
2
What access would an attacker need?
Exploitation requires local access and user interaction, with no privileges required. The attack complexity is rated high.
3
What is the likely security impact?
The CVSS vector indicates a high confidentiality impact, consistent with information disclosure. No integrity or availability impact is indicated.