CVE-2017-9724: High severity Google Android vulnerability
Published Sep 5, 2017
·Updated
In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specifically the ION cache maintenance code is writing to a user supplied address.
Affected Software
2 affected components
Google Android<=8.0
Google Android
Event History
Sep 5, 2017
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Sep 21, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Mar 8, 58506
Event
08:56 PM
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access with no privileges required, but user interaction is required. The flaw involves user-level permissions being used to access kernel memory.
2
Which devices are in scope?
The issue affects Qualcomm products with Android releases from CAF that use the Linux kernel. The listed software is Google Android.
3
What is the potential impact after exploitation?
The CVSS vector rates confidentiality, integrity, and availability impacts as high. The vulnerable ION cache maintenance code writes to a user-supplied address in kernel memory.